kibana语法

通过kibana对es进行crud：

基本语法：

//创建一个简单索引
PUT /bsfit
//查看索引
GET /bsfit
//查看索引详细信息
GET /_cat/indices?v
//删除索引
DELETE /bsfit
//创建一个索引，并指定type和mapping，
PUT /bsfit
{
  "mappings": {
    "member":{
      "properties": {
        "id":{
          "type": "text"
        },
        "name":{"type": "keyword"},
        "age":{"type": "integer"},
        "info":{
          "type": "text"
        }
      }
    }
  }
}
//查看mapping
GET /bsfit/_mapping

//创建一条document
PUT /bsfit/member/1
{
  "id":"1001",
  "name":"test01",
  "age":7,
  "info":"hello bsfit"
}

//查看指定document
GET /bsfit/member/1

//更新doc,注意需要在后面加上_update,否则会覆盖全部,如果需要添加新的字段就直接在doc里面添加
POST /bsfit/member/1/_update
{
  "doc": {
    "info":"hello bsfit !!!"
  }
}

//使用script在原数据上进行操作,需要注意数据类型
POST /bsfit/member/1/_update
{
  "script": "ctx._source.age += 3"
}

//删除指定doc
DELETE /bsfit/member/1

高级语法：

批量添加：

//批量添加,其中_id若自己指定就是自己指定的id,如果为空，系统会随机指定一个id
POST /bsfit/member/_bulk
{"index":{"_id":1}}
  {"id":"1","name":"bsfit","age":"9","info":"hello bsfit"}
{"index":{}}
  {"id":"2","name":"bsfit","age":"10","info":"hello bsfit"}

使用URL格式进行检索

//**********************使用URL格式进行检索******************************
//查询所有
GET /bsfit/member/_search?q=*
//查询所有并按照年龄倒序输出
GET /bsfit/member/_search?q=*&sort=age:desc
//分页：查询所有，按照年龄倒序输出，并设置页大小为2，从0开始，（from=（页数 - 1 ）*2）
GET /bsfit/member/_search?q=*&sort=age:desc&size=2&from=0

使用DSL格式进行检索

//**********************使用DSL格式进行检索******************************
//查询所有
GET /bsfit/member/_search
{
  "query": {"match_all": {}}
}
//分页查看
GET /bsfit/member/_search
{
  "query": {"match_all": {}},
  "size":2,
  "from": 0
}
//按照年龄倒序分页检索
GET /bsfit/member/_search
{
  "query": {"match_all": {}},
  "sort": [
    {
      "age": {
        "order": "desc"
      }
    }
  ], 
  "size":2,
  "from": 0
}
//通过指定"_source"来筛选字段
GET /bsfit/member/_search
{
  "query": {"match_all": {}},
  "_source": ["name","age"], 
  "sort": [
    {
      "age": {
        "order": "desc"
      }
    }
  ], 
  "size":2,
  "from": 0
}

Term Query

//关键字检索：
//检索规则：除text外，其他类型均不分词
//默认使用标准分词器，英文按单词分词，中文按字分词
GET /bsfit/member/_search
{
  "query": {
    "term": {
      "info": {
        "value": "hello"
      }
    }
  }
}

Range Query

//范围查询：检索符合0<=age<=15的记录：
GET /bsfit/member/_search
{
  "query": {
    "range": {
      "age": {
        "gte": 0,
        "lte": 15
      }
    }
  }
}

Prefix Query

//前缀查询：查询name中以bsf开头的记录，注意：前缀查询针对分词的最小单位，如非text类型，或者text类型中的英文单词
GET /bsfit/member/_search
{
  "query": {
    "prefix": {
      "name": {
        "value": "bsf"
      }
    }
  }
}

Wildcard Query

//通配符查询：*表示0到多个字符，?表示单个字符
GET /bsfit/member/_search
{
  "query": {
    "wildcard": {
      "name": {
        "value": "b*"
      }
    }
  }
}

GET /bsfit/member/_search
{
  "query": {
    "wildcard": {
      "name": {
        "value": "test0?"
      }
    }
  }
}

Fuzzy Query

规则：
The fuzziness parameter can be specified as:
0，1，2
the maximum allowed Levenshtein Edit Distance (or number of edits)
AUTO
generates an edit distance based on the length of the term. Low and high distancearguments may be optionally provided AUTo:[ low], [high] , if not specified, the defaultvalues are 3 and 6, equivalent to AUTO:3,6 that make for lengths:
0…2
must match exactly
3…5
one edit allowed
>5
two edits allowed
AUTO should generally be the preferred value for fuzziness .

//模糊查询：允许0~2个错误，
GET /bsfit/member/_search
{
  "query": {
    "fuzzy": {
      "name": "bsfffit"
    }
  }
}

Bool Query

//布尔查询：must:and should:or must_not:not，
GET /bsfit/member/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "name": {
              "value": "bsfit"
            }
          }
        }
      ],
      "must_not": [
        {
          "range": {
            "age": {
              "gte": 10
            }
          }
        }
      ]
    }
  }
}

Multi_match Query

//多字段查询：在多个字段中查询，
GET /bsfit/member/_search
{
  "query": {
    "multi_match": {
      "query": "bsfit",
      "fields": ["name","info"]
    }
  }
}
//设置默认字段
GET /bsfit/member/_search
{
  "query": {
    "query_string": {
      "default_field": "info",
      "query": "hello"
    }
  }
}
//多字段查询的另一种方式，analyzer表示选用的分词器
GET /bsfit/member/_search
{
  "query": {
    "query_string": {
      "query": "bsfit",
      "fields": ["info","name"],
      "analyzer": "standard"
    }
  }
}

Highlight Query

高亮查询：
fields表示选中的字段，*表示全部，
pre_tags和post_tags用于自定义高亮的html标签，
require_field_match 如果值为true表示仅在选中的字段(term中指定的字段)中高亮显示

GET /bsfit/member/_search
{
  "query": {
    "term": {
      "info": {
        "value": "bsfit"
      }
    }
  },
  "highlight": {
    "fields": {"*":{}},
    "pre_tags": ["<span style='color:red'>"],
    "post_tags": ["</span>"],
    "require_field_match":false
  }
}