Elasticsearch 常用语法

一、创建索引
#创建索引，默认设置
PUT /index

#查看索引
GET /index/_settings

#查看所有索引
GET _all/_settings

二、新增文档
#指定ID添加文档
PUT /index/_doc/1
{
  "name":"沧月",
  "age":23,
  "sex":"男"
}

#不指定ID添加文档
POST /lib/user
{
  "name":"南风",
  "age":23,
  "sex":"男"
}

三、删除更新文档
#更新文档，直接覆盖
PUT /lib/user/1
{
  "name":"大名",
  "age":23,
  "sex":"男"
}

#更新文档，只更新部分字段
POST /lib/user/1/_update
{
  "doc":{
    "age":22
  }
}


#使用script更新指定文档,如果该文档不存在则新增该文档（views为对象字段）
POST /test/_update/3
{
   "script" : "ctx._source.views+=1;ctx._source.views+=1",
   "upsert": {
       "views": 1,
       "name": "cangyue"
   }
}

#更新全部文档（ps_num，amount为对象字段）
POST /act-*/_update_by_query
{
  "script": {
    "lang": "painless",
    "inline": "ctx._source.ps_num= ctx._source.amount/1000"
  }
}

#分割字符串并更新字段(忘了叫啥语法了？反正用Java的语法写也没得问题)
POST /ps-*/_update_by_query?conflicts=proceed
{
  "script": {
    "source": """
    if(ctx._source['pid_str'] instanceof String){
      String s=ctx._source['pid_str'];
      ArrayList array=new ArrayList();
      if(!s.isEmpty()){
         String splitter = ",";
         StringTokenizer tokenValue = new StringTokenizer(s, splitter);
         while (tokenValue.hasMoreTokens()) {
            array.add(tokenValue.nextToken());
         }
      }
     ctx._source.pid_array=array;
    }
"""
  }
}


#查询正在进行的任务
GET /_tasks?detailed=true&actions=*byquery


#根据条件更新全部文档
POST /user-gsp-detailes-202102/_update_by_query
{
  "query": {
    "terms": {
      "type.keyword": [
        "self_defaults",
        "ref_defaults"
      ]
    }
  }, 
  "script": {
    "lang": "painless",
    "inline": "ctx._source.amount=ctx._source.amount*-1"
  }
}


#删除一个索引
DELETE /index


#删除指定ID文档
DELETE /index/_doc/ID

#根据匹配条件删除文档
POST /match_another-*/_delete_by_query
{
   "query": {
      "match": {
         "etype.keyword": "2e"
      }
   }
}



四、查询文档

#查询文档
GET /test/_search

#指定查询字段查询
GET /test/_search
{
"_source": ["id","email","num"]
}

#指定查询返回数量
GET /test/_search
{
"size": 50
}

#查询结果排序
GET /test/_search
{
"sort": [
    {
      "num": {
        "order": "desc"
      }
    }
  ]
}

#简单条件过滤查询
GET /test/_search
{
  "query": {
    "terms": {
      "email.keyword": [
        "444@qq.com",
        "333@163.com"
]
    }
  }
}
#简单条件过滤查询
GET /test/_search
{
  "query": {
    "term": {
 "email.keyword":"444@qq.com"
    }
  }
}

#多条件筛选
GET /test/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "status.keyword": "-1"
          }
        },
        {
          "range":{
          "add_time":{
            "gte":1611244800000,
            "lte":1611331199000
          }
        }
        }
      ]
    }
  }
}


# and 加 OR 混合查询（类似：select * from table where tx=1 and (id=1 or pid_array=8)）
GET /table/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "tx.keyword": "1"
          }
        },
        {
          "bool": {
            "should": [
              {
                "term": {
                  "id": {
                    "value": "1"
                  }
                }
              },
              {
                "term": {
                  "pid_array.keyword": {
                    "value": "8"
                  }
                }
              }
            ]
          }
        }
      ]
    }
  },
  "size": 20
}

或者

GET /table/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "tx.keyword": "1"
          }
        }
      ],
      "should": [
        {
          "term": {
            "id": "-2"
          }
        },
        {
          "term": {
            "pid_array.keyword": "-2"
          }
        }
      ],
      "minimum_should_match": 1
    }
  },
  "size": 20
}




#模糊匹配加条件筛选
GET /test/_search
{
  "query":{
    "bool":{
      "must":[
        {
          "wildcard": {
            "pid.keyword": {
              "value": "*100242,*"
            }
          }
        },
        {
          "term": {
            "status.keyword": "-1"
          }
        }
      ],
      "filter":{
        "range":{
          "add_time":{
            "gte":1611244800000,
            "lte":1611331199000
          }
        }
        
      }
    }
  },
  "size": 20
}

#条件过滤加聚合计算
GET /ps-202010/_search
{
  "query":{
    "bool":{
      "must":[
        {
          "wildcard": {
            "pid.keyword": {
              "value": "*101866*"
            }
          }
        },
        {
          "term": {
            "status.keyword": "-1"
          }
        }
      ],
      "filter":{
        "range":{
          "add_time":{
            "gte":1602301182695,
            "lte":1612301182695
          }
        }
        
      }
    }
  },
  "aggs": {
    "v_sum": {
      "sum": {
        "field": "amount"
      }
    },
    "v_count": {
      "value_count": {
        "field": "id"
      }
    }
  },
  "size": 0
}

#单个字段分组聚合计算并对结果集排序
GET /test/_search
{
  "aggs": {
    "test": {
      "terms": {
        "field": "user_id.keyword",
        "size": 100,
        "order": {
          "amount": "desc"
        }
      },
      "aggs": {
        "amount": {
          "sum": {
            "field": "amount"
          }
        }
      }
    }
  },
  "size": 0
}

或者
GET /act-*/_search
{
  "size": 0, 
  "query": {
    "term": {
      "user_id.keyword": {
        "value": "Sebu0220"
      }
    }
  }, 
  "aggs": {
    "groupBy": {
      "terms": {
        "field": "ym.keyword",
        "size": 1000
        
      },
      "aggs": {
        "amount_sum": {
          "sum": {
            "field": "amount"
          }
        },
        "num_sum":{
          "sum": {
            "field": "num"
          }
        }
      }
    }
  }
}

#多个字段分组聚合计算
GET /test/_search
{
  "size": 0, 
  "aggs": {
    "groupBy": {
      "composite": {
        "size": 1200, 
        "sources": [
          {
            "ym_group": {
              "terms": {
                "field": "ym.keyword" //分组字段1
              }
            }
          },
          {
            "email_group": {
              "terms": {
                "field": "master_email.keyword" //分组字段2

              }
            }
          }
        ]
      },
      "aggs": {
          "amount_sum": {
            "sum": {
              "field": "amount"
            }
          },
        "num_sum":{
          "sum": {
            "field": "num"
          }
        }
      }
    }
  }
}