Kibana结合Elasticsearch的使用

前提:kibana和ES都启动的情况下

ES访问地址:http://10.1.1.236:9200/

Kibana访问地址:http://10.1.1.236:5601/

操作步骤:进入kibana后,点击左侧的Dev Tools

kibana es清空数据 kibana操作es数据_搜索

ES文档操作

ES是面向文档的,存储文档的同时对其进行索引使其能被搜索到。

1.创建文档

一层json

三层json带列表

3层json

PUT /hmf/_doc/1

{

  "id":1,

  "username":"李四"

}

PUT /hmf/_doc/2

{

  "grocery_name": "Elastic Eats",

  "items": [

    {

      "name": "banana",

      "stock": "12",

      "category": "fruit"

    },

    {

      "name": "peach",

      "stock": "10",

      "category": "fruit"

    }]

}

PUT /hmf/_doc/3

{"query":{"term":{"name":"hmf"}}}

示例:

kibana es清空数据 kibana操作es数据_ci_02

 2.读取文档

//返回全部数据

GET /hmf/_doc/1

//返回部分数据

GET /hmf/_doc/1?_source=username

3.更新文档

//全局更新,如果你更新的时候漏写了字段,就会被覆盖,相当于全局覆盖

POST /hmf/_doc/1

{

  "id":1,

  "username":"张三"

}

POST /hmf/_update/1

{

  "doc":{"aoeAes":"胡秀梅edit"}

}

两者区别是局部更新不会删除已有的但是更新中没有写的字段,它会保持原样

4.删除文档

//删除文档

DELETE /hmf/_doc/4

5.批量读取文档

GET /hmf/_doc/_mget

{

  "ids":["1","2"]

}

6.查询字符串搜索

GET /hmf/_doc/_search?q=id:1

7.分页搜索

GET /hmf/_doc/_search?size=1&from=0

8.过滤搜索

//具体搜索

//模糊搜索

GET /hmf/_doc/_search

{

  "query": {

    "match":{

        "username": "张三"

    }

  }

}

//模糊搜索

GET /hmf/_doc/_search

{

  "query": {

    "match":{

        "username": "张*"

    }

  }

}

//模糊搜索

GET /hmf/_doc/_search

{

  "query": {

    "wildcard":{

        "username": "张*"

    }

  }

}

相关命令:

类别

Kibana_Proxy支持的命令

示例

创建文档

PUT /{index}/_doc/{id}

PUT /estest/_doc/1

{

 "aoeId" : "1",

 "aoeAes" : "吴秀梅",

 "aoeSm4" : "北京市海淀区",

 "aoeEmail" : "qianxiulan@yahoo.com",

 "aoePhone" : "15652996964",

 "aoeIdCard" : "210302199608124861",

 "aoeOfficerCard" : "武水电字第3632734号",

 "aoePassport" : "BWP018930705",

 "aoeGeneralIdCard" : "0299233902",

 "aoeCreditCard" : "6212262502009182455"

}

POST /{index}/_doc/{id}


POST /estest/_doc/1 Json同上

PUT /{index}/_create/{id}

PUT /estest/_create/1    Json同上

POST /{index}/_create/{id}

POST /estest/_create/1   Json同上

POST /{index}/_doc

POST /estest/_doc Json同1

PUT /{index}_doc/1/_create

PUT /estest/_doc/1/_create Json同上

POST /{index}_doc/1/_create

POST /estest/_doc/2/_create Json同上

POST /{index}/{id}

POST /estest/1 同上

PUT /{index}/{type}/{id}

PUT /estest/demo/1 Json同上

POST /{index}/{type}/{id}

POST /estest/demo/1 Json同上

PUT /{index}/{type}/{id}/_create

PUT /estest/demo/1/_create Json同上

POST /{index}/{type}/{id}/_create

POST /estest/demo/1/_create Json同上

更新文档

POST /{index}/_update/{id}

POST /estest/_update/1

{

  "doc":{"aoeAes":"胡秀梅edit"}

}

POST /{index}/{type}/{id}/_update

POST /estest/_doc/1/_update

{

  "doc":{"aoeAes":"胡秀梅edit"}

}

PUT /{index}/_doc/{id}

PUT /estest/_doc/1   

POST /{index}/_doc/{id}

POST /estest/_doc/1 Json同创建

搜索文档

GET /{index}/_search

GET /estest/_search 

POST /{index}/_search

POST /estest/_search

GET /{index}/{type}/_search

GET /estest/_doc/_search

POST /{index}/{type}/_search

POST /estest/_doc/_search

字段type设置成keyword才能用query进行搜索


搜索支持的json:{"query":{"term":{field:data}}}

GET /estest/_search

{

  "query":{"term":{"aoeAes":"吴秀梅"}}

}

搜索支持的json:{"query":{"term":{field:{"value":data}}}}

GET /estest/_search

{

  "query":{"term":{"aoeAes":{"value":"吴秀梅"}}}

}

GET /{index}/{type}/{id}

GET /estest/_doc/1

删除文档

DELETE /{index}/{type}/{id}

批量添加

PUT /_bulk

PUT /_bulk

{"create":{"_index":"estest","_type":"_doc","_id":"1"}}

{"aoeId":"1","aoeAes":"吴秀梅","aoeSm4":"北京市海淀区","aoeEmail":"qianxiulan@yahoo.com","aoePhone":"15652996964","aoeIdCard":"210302199608124861","aoeOfficerCard":"武水电字第3632734号","aoePassport":"BWP018930705","aoeGeneralIdCard":"0299233902","aoeCreditCard":"6212262502009182455"}

POST /_bulk

JSON同上

PUT /{index}/_bulk

PUT /estest/_bulk

{"index":{"_id":1}}

{"aoeId":"1","aoeAes":"吴秀梅444","aoeSm4":"北京市海淀区","aoeEmail":"qianxiulan@yahoo.com","aoePhone":"15652996964","aoeIdCard":"210302199608124861","aoeOfficerCard":"武水电字第3632734号","aoePassport":"BWP018930705","aoeGeneralIdCard":"0299233902","aoeCreditCard":"6212262502009182455"}

POST /{index}/_bulk

JSON同上

PUT /{index}/{type}/_bulk

PUT /estest/_doc/_bulk

{"index":{"_id":1}}

{"aoeId":"1","aoeAes":"吴秀梅444","aoeSm4":"北京市海淀区","aoeEmail":"qianxiulan@yahoo.com","aoePhone":"15652996964","aoeIdCard":"210302199608124861","aoeOfficerCard":"武水电字第3632734号","aoePassport":"BWP018930705","aoeGeneralIdCard":"0299233902","aoeCreditCard":"6212262502009182455"}

POST /{index}/{type}/_bulk

JSON同上

批量更新

PUT /_bulk

PUT /_bulk

{"update":{"_index":"estest","_type":"_doc","_id":"1"}}

{"doc":{"aoeAes":"吴秀"}}

POST /_bulk

JSON同上

批量查询不支持

GET /_msearch

GET /_msearch

{"index" : "estest"}

{"query":{"match_all":{}}}


GET /_msearch

{"index" : "estest"}

{"query":{"match":{"aoeAes":"吴秀梅"}}}

GET /_search

关键字match

GET /estest/_search

{

  "query": {

    "match": {

      "aoeAes": "吴秀梅"

    }

  }

}

关键字match_phrase

GET /estest/_search

{

  "query": {

    "match_phrase": {

      "aoeAes": "吴秀梅"

    }

  }

}

GET /estest/_search?q={field}:"{data}"

GET /estest/_search?q=aoeAes:"吴秀梅"

新增JSON级别

一层JSON

策略例如:$.cityName

{

    "grpNo":"191",

    "cityId":"20001",

    "cityName":"北京"  

}

二层JSON

策略例如:$.a.desc

{

    "grpNo":"191",

    "cityId":"20001",

    "cityName":"北京",

    "a":{

        "desc":"测试描述",

        "grpOrderNo":"G330200008210120003250",

        "payTypeCode":"a"

    }

}

三层Json

策略例如:$.a.b.name

{

    "grpNo":"191",

    "cityId":"20001",

    "cityName":"北京",

    "a":{

        "desc":"测试描述",

        "grpOrderNo":"G330200008210120003250",

        "payTypeCode":"a",

        "b":{

            "name":"estest",

            "mobilePhone":"15320123650"

        }

    }

}

四层JSON

策略例如:$.a.b.c.city

{

    "grpNo":"191",

    "cityId":"20001",

    "cityName":"北京",

    "a":{

        "desc":"测试描述",

        "grpOrderNo":"G330200008210120003250",

        "payTypeCode":"a",

        "b":{

            "name":"estest",

            "mobilePhone":"15320123650",

            "c":{

                "city":"宁波市",

                "county":"北仑区"

            }

        }

    }

}

五层JSON

策略例如:

{

    "grpNo":"191",

    "cityId":"20001",

    "cityName":"北京",

    "a":{

        "desc":"测试描述",

        "grpOrderNo":"G330200008210120003250",

        "payTypeCode":"a",

        "b":{

            "name":"estest",

            "mobilePhone":"15320123650",

            "c":{

                "city":"宁波市",

                "county":"北仑区",

                "d":{

                    "street":"培新街",

                    "number":"5号院"

                }

            }

        }

    }

}

Store存储(字段keyword)的数据结构查询正常解密
一层JSON

GET /{index}}/_doc/{id}?stored_fields={fields},{fields]

GET /fstest/_doc/1?stored_fields=a,b,c

二层

GET /fstest/_doc/1?stored_fields=a,b,c,d.ee

三层

GET /fstest/_doc/1?stored_fields=a,b,c,d.ee,d.ff.ggg

四层

GET /fstest/_doc/1?stored_fields=a,b,c,d.ee,d.ff.ggg,d.ff.hhh.iiii

五层

GET /fstest/_doc/1?stored_fields=a,b,c,d.ee,d.ff.ggg,d.ff.hhh.iiii,d.ff.hhh.jjjj.kkkkk

filter测试(字段keyword)

POST /dstest/_search

{

  "query":{

    "bool": {

    "should": [

      {"bool": {

        "filter": [

          {"term": {"cityName": "北京"}}]

      }}

    ]

    }

  }

}

POST /dstest/_search

{

  "query":{

    "bool": {

     "filter": {"term": {"cityName": "北京"}}

    }

  }

}

POST /dstest/_search

{

  "query":{

    "bool": {

     "filter": {"term": {"a.desc": "测试描述"}}

    }

  }

}

POST /dstest/_search

{

  "query":{

    "bool": {

      "must": {"term": {"cityName": "北京"}},

      "filter": {"term": {"a.desc": "测试描述"}}

    }

  }

}

POST /dstest/_search

{

  "query":{

    "bool": {

     "must_not": {"term": {"cityName": "北京"}}

    }

  }

}

GET /dstest/_search

{

  "query": {

    "constant_score": {

      "filter": {

        "term": {

          "cityName": "北京"

        }

      }

    }

  }

}