Elasticsearch 认证模拟题 -2

一、题目

有一个索引 task3，其中有 fielda，fieldb，fieldc，fielde 现要求对 task3 重建索引，重建后的索引新增一个字段 fieldg 其值是fielda，fieldb，fieldc，fielde 的值拼接而成。

# 创建符合条件的 task3 索引，设置 field字段，并写入数据
PUT task3
{
  "mappings": {
    "properties": {
      "fielda":{
        "type": "keyword"
      },
      "fieldb":{
        "type": "keyword"
      },
      "fieldc":{
        "type": "keyword"
      },
      "fielde":{
        "type": "keyword"
      }
    }
  }
}

POST task3/_bulk
{"index":{}}
{"fielda":"aa","fieldb":"bb","fieldc":"cc","fielde":"dd"}
{"index":{}}
{"fielda":"中华","fieldb":"人民","fieldc":"共和国","fielde":"万岁"}

1.1 考点

1. 重建索引
2. 脚本
   • 在重建索引的文档中有此例
3. 或可以通过 管道 来解

1.2 答案

# 定义新的索引
PUT task4
{
  "mappings": {
    "properties": {
      "fielda":{
        "type": "keyword"
      },
      "fieldb":{
        "type": "keyword"
      },
      "fieldc":{
        "type": "keyword"
      },
      "fielde":{
        "type": "keyword"
      },
      "fieldg":{
        "type": "keyword"
      }
    }
  }
}

#  重建索引
POST _reindex
{
  "source": {
    "index": "task3"
  },
  "dest": {
    "index": "task4"
  },
  "script": {
    "source": """
    ctx._source.fieldg = "";
    ctx._source.fieldg = ctx._source.fieldg + ctx._source.fielda + "-";
    ctx._source.fieldg = ctx._source.fieldg + ctx._source.fieldb + "-";
    ctx._source.fieldg = ctx._source.fieldg + ctx._source.fieldc + "-";
    ctx._source.fieldg = ctx._source.fieldg + ctx._source.fielde;
    """
  }
}

24-06-30 补充一下管道的解法

# 管道效果预览
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "script": {
          "description": "Extract 'tags' from 'env' field",
          "lang": "painless",
          "source": """
          if (ctx['fielda'] != null && ctx['fieldb'] != null && ctx['fieldc'] != null && ctx['fielde']!= null){
            ctx['fieldg'] = ctx['fielda'] + ' ' + ctx['fieldb'] + ' '+ ctx['fieldc'] + ' '+ctx['fielde'];
          }
          """,
          "ignore_failure": true
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "fielda": "中华",
        "fieldb": "人民",
        "fieldc": "共和国",
        "fielde": "万岁"
      }
    }
  ]
}

# 定义管道
PUT _ingest/pipeline/task3_pipeline
{
  "processors": [
      {
        "script": {
          "description": "Extract 'tags' from 'env' field",
          "lang": "painless",
          "source": """
          if (ctx['fielda'] != null && ctx['fieldb'] != null && ctx['fieldc'] != null && ctx['fielde']!= null){
            ctx['fieldg'] = ctx['fielda'] + ' ' + ctx['fieldb'] + ' '+ ctx['fieldc'] + ' '+ctx['fielde'];
          }
          """,
          "ignore_failure": true
        }
      }
    ]
}

# 重建索引引用管道
POST _reindex
{
  "source": {
    "index": "task3"
  },
  "dest": {
    "index": "task3_new",
    "pipeline": "task3_pipeline"
  }
}

# 查询结果
POST task3_new/_search
{
  "query": {
    "match_all": {}
  }
}

二、题目

在集群上有一个索引 task1，编写一个查询并满足以下要求:
1. 定义一个名为 a 的运行时字段，通过 a 字段实现以下聚合（a 字段的值等于 b 字段减去 c 字段）
2. 聚合a值小于-2的文档
3. 聚合-5到5之间的文档
4. 聚合大于5的文档
5. 建立测试索引

# 创建索引
PUT task1
{
  "mappings": {
    "properties": {
      "b":{
        "type": "double"
      },
      "c":{
        "type": "double"
      }
    }
  }
}

# 写入数据
POST task1/_bulk
{"index":{}}
{"b":2,"c":3}
{"index":{}}
{"b":5,"c":1}
{"index":{}}
{"b":6,"c":1}
{"index":{}}
{"b":1,"c":7}

2.1 考点

1. 聚合：这里用到的范围聚合
2. 运行时字段

2.2 答案

# 使用 runtime_mappings 进行聚类
GET task1/_search
{
  "runtime_mappings": {
    "a": {
      "type": "double",
      "script": {
        "source": """
          emit(doc['b'].value - doc['c'].value)
        """
      }
    }
  },
  "aggs": {
    "bucket_ranges": {
      "range": {
        "field": "a",
        "ranges": [
          { "to": -2 },
          { "from": -5, "to": 5 },
          { "from": 5 }
        ]
      }
    }
  }
}