(根据自己的需求做了一些总结,可能不够全面,如果哪里表述不够清晰给我留言我们一起探讨。我也刚刚接触,可能有些地方的理解比较片面,欢迎指出。)
1.查看集群健康状况

GET /_cat/health?v

2.查看节点列表

GET /_cat/nodes?v

3.查看index列表

GET /_cat/indices?v

查看mapping

GET /index/type/_mapping

4.删除索引

DELETE /test

5.查询是否锁住swapping

GET _nodes?filter_path=**.mlockall

6.创建mapping

1. text属性默认会分词,并且会创建一个keyword,根据官方建议聚合操作时使用keyword字段。
PUT index
{
  "mappings": {
    "type": {
      "properties": {
        "name": {
          "type": "keyword"
        },
        "age": {
          "type": "long"
        },
        "birth": {
          "type": "date",
          "format": "yyyy-MM-dd HH:mm:ss"
        },
        "hobbies": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword"
            }
          }
        }
      }
    }
  }
}
2. 也可以通过设置fielddata=true针对分词后的词语进行聚合操作(创建mapping之后也可以更改):
PUT index/_mapping/type
{ 
  "properties":{ 
    "vendor":{
      "type":"text",
      "fielddata":true 
    } 
  } 
}
3. 有一些防止映射爆炸的配置可以根据自己的需求更改,我的需求中出现mapping爆炸字段过多,所以我通过设置索引中的最大字段数来控制,默认值是1000,以下是更改示例,别的属性也可以参考以下示例进行更改:
PUT index
{
  "settings": {
    "index.mapping.total_fields.limit": 100000
  },
  "mappings": {
    "type": {
      "properties": {
        "name": {
          "type": "keyword"
        },
        "age": {
          "type": "long"
        }
      }
    }
  }
}
4. 设置动态mapping模板,传入数据有时没有创建这个字段的mapping,默认elasticsearch会自动检索数据类型并创建mapping,动态检索可以通过设置关闭。"date_detection": false是默认不检索date类型,如果检索到此类型数据创建mapping时为text属性:
PUT index
{
  "mappings": {
    "type": {
      "date_detection": false,
      "properties": {
        "name": {
          "type": "keyword"
        },
        "age": {
          "type": "long"
        }
      }
    }
  }
}

7.添加数据
elasticsearch没有数组格式但是默认数据为数组格式,这里我演示了如何添加数组格式的数据

POST /index/type/1
{
  "name": "张三",
  "age": 18,
  "birth": "2000-07-07 17:19:50",
  "hobbies": ["打网球","踢足球","篮球","游泳"]
}

8.一些查询语句
我一般都是中文的需求所以一般我都会使用短语查询

1. 短语查询(可以查询hobbies中含有 ‘网球’短语的所有docs)
GET /index/type/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "hobbies": "网球"
          }
        }
      ]
    }
  }
}
2. hobbies为网球的年龄分布

注:size用来控制显示条数

GET /index/type/_search?size=0
{
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "hobbies": "网球"
          }
        }
      ]
    }
  },
  "aggs": {
    "group_by_age": {
      "terms": {
        "size": 10, 
        "field": "age"
      }
    }
  }
}
3. 根据hobbies分组再根据age分组
GET /index/type/_search?size=0
{
  "aggs": {
    "group_by_hobbies": {
      "terms": {
        "field": "hobbies.keyword"
      },
      "aggs": {
        "group_by_age": {
          "terms": {
            "field": "age"
          }
        }
      }
    }
  }
}
4. 根据出生日期排序
GET /index/type/_search
{
  "sort": [
    {
      "birth": {
        "order": "desc"
      }
    }
  ]
}
5. 总共有多少种爱好(去重加法)
GET /index/type/_search
{
  "aggs": {
    "count_hobbies": {
      "cardinality": {
        "field": "hobbies.keyword"
      }
    }
  }
}
6.  根据年分组
GET /index/type/_search
{
   "aggs": {
      "sales": {
         "date_histogram": {
            "field": "birth",
            "interval": "year", 
            "format": "yyyy" 
         }
      }
   }
}
7. 根据年分组再根据月分组

创建mapping时没有没有指定时间format的话,查询也可以指定,默认date进入时是一个UTC格式的时间戳,通过以下操作可以将存入的时间format之后显示。

GET /index/type/_search?size=0
{
  "aggs": {
    "by_year": {
      "date_histogram": {
        "field": "birth",
        "interval": "year",
        "format": "yyyy",
        "time_zone": "Asia/Shanghai"
      },
      "aggs": {
        "by_month": {
          "date_histogram": {
            "field": "birth",
            "interval": "month",
            "format": "yyyy-MM",
            "time_zone": "Asia/Shanghai"
          }
        }
      }
    }
  }
}
8. 6.0之后_all字段被默认关闭,如果想要全文检索可以通过default_field字段
GET /index/type/_search
{ 
    "query":{ 
        "query_string":{ 
          "default_field": "*",
          "query": "抱歉"
        } 
    } 
}
9. Delete By Query API

scroll_size控制批处理大小,默认是1000

POST index/_delete_by_query?scroll_size=5000
{
  "query": {
    "match_phrase": {
      "hobbies": "网球"
    }
  }
}

10.重定向index
注:数量过多时耗时会很长,kibana会返回请求超时的提示,但是es会继续将你设置的数目全部重定向到新的dst_index为止。要求(type必须一致)

POST _reindex
{
  "size": 1000000,
  "source": {
    "index": "src_index"
  },
  "dest": {
    "index": "dst_index"
  }
}

11.动态检测到double 和 long 类型默认类型为keyword

PUT index
{
  "mappings": {
    "type": {
      "dynamic_templates": [
        {
          "floats": {
            "match_mapping_type": "double",
            "mapping": {
              "type": "keyword"
            }
          }
        },
        {
          "longs": {
            "match_mapping_type": "long",
            "mapping": {
              "type": "keyword"
            }
          }
        }
      ]
    }
  }
}