# 真实磁盘用量
GET _cat/allocation?v&h=disk.percent,disk.used,disk.avail,disk.total,node

# 段内存、 fielddata、查询缓存
GET _stats?level=indices&metric=store,segments,fielddata,query_cache,request_cache

# 节点级别占用
GET _nodes/stats/fs?filter_path=nodes.*.fs.total

# 索引级别占用
GET _cat/indices?v&s=store.size:desc&h=index,health,status,pri,rep,docs.count,store.size


先看索引总大小、文档数、删除文档数：
GET _cat/indices/test_api_review-202603?v&bytes=mb
看每个主分片/副本分片占用：
GET _cat/shards/test_api_review-202603?v&bytes=mb
看更详细的 store/indexing/search/segments 统计：
GET test_api_review-202603/_stats?human=true
如果只关心磁盘存储：
GET test_api_review-202603/_stats/store?human=true
看 Lucene segment 占用，能看到删除文档、段数量这类信息：
GET test_api_review-202603/_segments
如果你想直接算“平均每条文档占用”，建议查这个，返回 JSON 好取值：
GET test_api_review-202603/_stats/docs,store?human=true

#  update_by_query
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "status": {
              "value": 13
            }
          }
        },
        {
          "term": {
            "cust_id": {
              "value": "xxx"
            }
          }
        },
        {
          "terms": {
            "app_id": [
              "adddd",
              "assss"
            ]
          }
        }
      ],
      "must_not": [
        {
          "exists": {
            "field": "show_result"
          }
        }
      ]
    }
  },
  "doc": {
    "show_result": "不违规"
  }
}

{
  "aggs": {
    "date_buckets": {
      "date_histogram": {
        "field": "created_at",
        "time_zone": "+08:00",
        "fixed_interval": "1d",
        "format": "yyyy-MM-dd",
        "min_doc_count": 0,
        "extended_bounds": {
          "min": 1700000000000,
          "max": 1700000000000
        }
      },
      "aggs": {
        "risk_count": {
          "filter": {
            "term": {
              "show_result": "risk"
            }
          }
        },
        "no_risk_count": {
          "filter": {
            "term": {
              "show_result": "no_risk"
            }
          }
        },
        "review_count": {
          "filter": {
            "term": {
              "show_result": "risk"
            }
          }
        }
      }
    }
  }
}