kibana智能检索发送多次_msearch —— 配置index pattern，同时设置时间段，就知道到底是在哪些索引里去查找数据了

kibanasite/elasticsearch/log-*/_field_stats?level=indices

{"_shards":{"total":600,"successful":600,"failed":0},"indices":{"log-2017.11.22-19-192.168.2.3-93004":{"fields":{"ReceiveDate":{"type":"date","max_doc":24117711,"doc_count":24117711,"density":100,"sum_doc_freq":-1,"sum_total_term_freq":24117711,"searchable":true,"aggregatable":true,"min_value":1511348400000,"min_value_as_string":"2017-11-22T11:00:00.000Z","max_value":1511351999000,"max_value_as_string":"2017-11-22T11:59:59.000Z"}}},"log-2017.11.22-19-192.168.2.3-93005":{"fields":{"ReceiveDate":{"type":"date","max_doc":24108636,"doc_count":24108636,"density":100,"sum_doc_freq":-1,"sum_total_term_freq":24108636,"searchable":true,"aggregatable":true,"min_value":1511348400000,"min_value_as_string":"2017-11-22T11:00:00.000Z","max_value":1511351999000,"max_value_as_string":"2017-11-22T11:59:59.000Z"}}},"log-2017.11.22-19-192.168.2.3-93002":{"fields":{"ReceiveDate":{"type":"date","max_doc":24123473,"doc_count":24123473,"density":100,"sum_doc_freq":-1,"sum_total_term_freq":24123473,"searchable":true,"aggregatable":true,"min_value":1511348400000,"min_value_as_string":"2017-11-22T11:00:00.000Z","max_value":1511351999000,"max_value_as_string":"2017-11-22T11:59:59.000Z"}}},"log-2017.11.22-19-192.168.2.3-93003":{"fields":{"ReceiveDate":{"type":"date","max_doc":24109946,"doc_count":24109946,"density":100,"sum_doc_freq":-1,"sum_total_term_freq":24109946,"searchable":true,"aggregatable":true,"min_value":1511348400000,"min_value_as_string":"2017-11-22T11:00:00.000Z","max_value":1511351999000,"max_value_as_string":"2017-11-22T11:59:59.000Z"}}},"log-2017.11.22-19-192.168.2.3-93001":{"fields":{"ReceiveDate":{"type":"date","max_doc":24111347,"doc_count":24111347,"density":100,"sum_doc_freq":-1,"sum_total_term_freq":24111347,"searchable":true,"aggregatable":true,"min_value":1511348400000,"min_value_as_string":"2017-11-22T11:00:00.000Z","max_value":1511351999000,"max_value_as_string":"2017-11-22T11:59:59.000Z"}}}}}

 

上述是按照小时建立的索引。