get /_xpack/sql?format=txt { "query":" select spanId, avg(elapsed),count(1) from \"sc-log-wbjr_2022-01-21\" group by spanId having count(1) >100 order by count(1) desc " }
转移索引名字”xxx”
方式2: /_xpack/sql “””xxx”””
1 2 3 4 5 6 7 8
get /_xpack/sql?format=txt { "query":""" select spanId, avg(elapsed),count(1) from "sc-log-wbjr_2022-01-21" group by spanId having count(1) >100 order by count(1) desc """ }