Elasticsearch Source

Introduction #

SmartChart supports Elasticsearch as a data source. Write ES query DSL (JSON format body) in the dataset editor to query ES index data for visualization. Supports match, term, terms, multi_match, bool, and other query types.


Query Methods #

Fuzzy Query (match) #

body = {
    'query': {
        'match': {
            'name': 'John'
        }
    },
    'size': 20  # Default 10, max 10000
}

Exact Single Value (term) #

body = {
    'query': {
        'term': {
            'field1.keyword': 'value'
        }
    }
}

Exact Multiple Values (terms) #

body = {
    "query": {
        "terms": {
            "field1.keyword": ["value1", "value2"]
        }
    }
}

Multi-field Query (multi_match) #

body = {
    "query": {
        "multi_match": {
            "query": "search text",
            "fields": ["field1", "field2"]
        }
    }
}

Prefix Query #

body = {
    'query': {
        'prefix': {
            'field.keyword': 'prefix_value'
        }
    }
}

Wildcard Query #

body = {
    'query': {
        'wildcard': {
            'field1.keyword': '?value*'
        }
    }
}

Bool Query (must/should/must_not) #

# must = AND
body = {
    "query": {
        "bool": {
            'must': [
                {"term": {"field1.keyword": "value1"}},
                {"terms": {"field2": ["val1", "val2"]}}
            ]
        }
    }
}

# should = OR
body = {
    "query": {
        "bool": {
            'should': [
                {"term": {"field1.keyword": "value1"}},
                {"terms": {"field2": ["val1", "val2"]}}
            ]
        }
    }
}

# Nested bool
body = {
    "query": {
        "bool": {
            "must": [
                {"term": {"field1": "value1"}},
                {"bool": {
                    "should": [
                        {"term": {"field3": "value3"}},
                        {"term": {"field4": "value4"}}
                    ]
                }}
            ]
        }
    }
}