(根据自己的需求做了一些总结,可能不够全面,如果哪里表述不够清晰给我留言我们一起探讨。我也刚刚接触,可能有些地方的理解比较片面,欢迎指出。)
1.查看集群健康状况
GET /_cat/health?v
2.查看节点列表
GET /_cat/nodes?v
3.查看index列表
GET /_cat/indices?v
查看mapping
GET /index/type/_mapping
4.删除索引
DELETE /test
5.查询是否锁住swapping
GET _nodes?filter_path=**.mlockall
6.创建mapping
1. text属性默认会分词,并且会创建一个keyword,根据官方建议聚合操作时使用keyword字段。
PUT index
{
"mappings": {
"type": {
"properties": {
"name": {
"type": "keyword"
},
"age": {
"type": "long"
},
"birth": {
"type": "date",
"format": "yyyy-MM-dd HH:mm:ss"
},
"hobbies": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
}
}
}
}
}
2. 也可以通过设置fielddata=true针对分词后的词语进行聚合操作(创建mapping之后也可以更改):
PUT index/_mapping/type
{
"properties":{
"vendor":{
"type":"text",
"fielddata":true
}
}
}
3. 有一些防止映射爆炸的配置可以根据自己的需求更改,我的需求中出现mapping爆炸字段过多,所以我通过设置索引中的最大字段数来控制,默认值是1000,以下是更改示例,别的属性也可以参考以下示例进行更改:
PUT index
{
"settings": {
"index.mapping.total_fields.limit": 100000
},
"mappings": {
"type": {
"properties": {
"name": {
"type": "keyword"
},
"age": {
"type": "long"
}
}
}
}
}
4. 设置动态mapping模板,传入数据有时没有创建这个字段的mapping,默认elasticsearch会自动检索数据类型并创建mapping,动态检索可以通过设置关闭。"date_detection": false是默认不检索date类型,如果检索到此类型数据创建mapping时为text属性:
PUT index
{
"mappings": {
"type": {
"date_detection": false,
"properties": {
"name": {
"type": "keyword"
},
"age": {
"type": "long"
}
}
}
}
}
7.添加数据
elasticsearch没有数组格式但是默认数据为数组格式,这里我演示了如何添加数组格式的数据
POST /index/type/1
{
"name": "张三",
"age": 18,
"birth": "2000-07-07 17:19:50",
"hobbies": ["打网球","踢足球","篮球","游泳"]
}
8.一些查询语句
我一般都是中文的需求所以一般我都会使用短语查询
1. 短语查询(可以查询hobbies中含有 ‘网球’短语的所有docs)
GET /index/type/_search
{
"query": {
"bool": {
"must": [
{
"match_phrase": {
"hobbies": "网球"
}
}
]
}
}
}
2. hobbies为网球的年龄分布
注:size用来控制显示条数
GET /index/type/_search?size=0
{
"query": {
"bool": {
"must": [
{
"match_phrase": {
"hobbies": "网球"
}
}
]
}
},
"aggs": {
"group_by_age": {
"terms": {
"size": 10,
"field": "age"
}
}
}
}
3. 根据hobbies分组再根据age分组
GET /index/type/_search?size=0
{
"aggs": {
"group_by_hobbies": {
"terms": {
"field": "hobbies.keyword"
},
"aggs": {
"group_by_age": {
"terms": {
"field": "age"
}
}
}
}
}
}
4. 根据出生日期排序
GET /index/type/_search
{
"sort": [
{
"birth": {
"order": "desc"
}
}
]
}
5. 总共有多少种爱好(去重加法)
GET /index/type/_search
{
"aggs": {
"count_hobbies": {
"cardinality": {
"field": "hobbies.keyword"
}
}
}
}
6. 根据年分组
GET /index/type/_search
{
"aggs": {
"sales": {
"date_histogram": {
"field": "birth",
"interval": "year",
"format": "yyyy"
}
}
}
}
7. 根据年分组再根据月分组
创建mapping时没有没有指定时间format的话,查询也可以指定,默认date进入时是一个UTC格式的时间戳,通过以下操作可以将存入的时间format之后显示。
GET /index/type/_search?size=0
{
"aggs": {
"by_year": {
"date_histogram": {
"field": "birth",
"interval": "year",
"format": "yyyy",
"time_zone": "Asia/Shanghai"
},
"aggs": {
"by_month": {
"date_histogram": {
"field": "birth",
"interval": "month",
"format": "yyyy-MM",
"time_zone": "Asia/Shanghai"
}
}
}
}
}
}
8. 6.0之后_all字段被默认关闭,如果想要全文检索可以通过default_field字段
GET /index/type/_search
{
"query":{
"query_string":{
"default_field": "*",
"query": "抱歉"
}
}
}
9. Delete By Query API
scroll_size控制批处理大小,默认是1000
POST index/_delete_by_query?scroll_size=5000
{
"query": {
"match_phrase": {
"hobbies": "网球"
}
}
}
10.重定向index
注:数量过多时耗时会很长,kibana会返回请求超时的提示,但是es会继续将你设置的数目全部重定向到新的dst_index为止。要求(type必须一致)
POST _reindex
{
"size": 1000000,
"source": {
"index": "src_index"
},
"dest": {
"index": "dst_index"
}
}
11.动态检测到double 和 long 类型默认类型为keyword
PUT index
{
"mappings": {
"type": {
"dynamic_templates": [
{
"floats": {
"match_mapping_type": "double",
"mapping": {
"type": "keyword"
}
}
},
{
"longs": {
"match_mapping_type": "long",
"mapping": {
"type": "keyword"
}
}
}
]
}
}
}