Elasticsearch入门基础操作

查看所有Index:

        curl '172.18.165.251:9200/_cat/indices?v'

创建Index:

         curl -X PUT '172.18.165.251:9200/<IndexName>'

删除Index:

        curl -X DELETE '172.18.165.251:9200/<IndexName>'

创建mappings（个人理解为创建表结构）:

curl  -H "Content-Type: application/json" -X   PUT '172.18.165.251:9200/miniprogram_event_index/_mapping/_doc?include_type_name=true' -d '
{
  "properties": {
      "createtime": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "eventcode": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "eventname": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "followstatus": {
        "type": "long"
      },
      "followtime": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "followuserid": {
        "type": "long"
      },
      "followusername": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "gzhcode": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "gzhname": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "nickname": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "remarks": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "userid": {
        "type": "long"
      }
    }}'

插入一条数据： 

curl  -H "Content-Type: application/json" -X POST '172.18.165.251:9200/button_event_index/_doc/' -d '
{
  "eventcode": "0003",
  "eventname": "点击我的按钮",
  "userid": 2434,
  "gzhcode": "prodqkb",
  "createtime": "2021-10-15 17:27:59"
}' 

 查询Index中所有数据：

        curl '172.18.165.251:9200/button_event_index/_doc/_search?pretty=true'

范围查询: （range）

curl  -H "Content-Type: application/json" -X GET '172.18.165.251:9200/button_event_index/_search?pretty=true' -d '
{
    "query": {
        "range": {
            "createtime": {
                "gte": "2021-10-25", 
                "lte": "2021-10-26"
            }
        }
    }
}'

添加字段：

curl  -H "Content-Type: application/json" -X   PUT '172.18.165.251:9200/button_event_index/_mapping/_doc?include_type_name=true' -d '
{
  "properties":{
       "nickname":{
            "type":"text"
       }
  }
}' 

修改字段：(设置fielddata=true，字符串聚合时要使用)

curl  -H "Content-Type: application/json" -X   PUT '172.18.165.251:9200/button_event_index/_mapping/_doc?include_type_name=true' -d '
{
  "properties":{
       "eventcode":{
            "type":"text",
          "fielddata": true
       }
  }
}' 

给字段设置不分词：

curl  -H "Content-Type: application/json" -X   PUT '172.18.165.251:9200/button_event_index/_mapping/_doc?include_type_name=true' -d '
{
  "properties":{
       "gzhname":{
            "type":"text",
            "fields": {
               "keyword": {
                     "type": "keyword"
                }
           },
          "fielddata": true
       },
       "eventname":{
            "type":"text",
            "fields": {
               "keyword": {
                     "type": "keyword"
                }
           },
          "fielddata": true
       },
       "nickname":{
            "type":"text",
            "fields": {
               "keyword": {
                     "type": "keyword"
                }
           },
          "fielddata": true
       }
  }
}' 

根据时间删除历史数据：

curl  -H "Content-Type: application/json" -X   POST '172.18.165.251:9200/button_event_index/_delete_by_query?pretty' -d '
{
    "query":{ 
        "range": {
            "createtime": {
                "gte": "2000-01-01", 
                "lte": "2024-01-01"
            }
        }
     }
}'

聚合后再取其他不参与聚合的字段：

读《深入理解Elasticsearch》点滴-聚合-top_hits - 手握太阳 - 博客园

【开发心得】es字符串类型的RangeQuery时间比较_虹梦未来的博客-CSDN博客_es rangequery

GET查询，加.keyword与不加.keyword的区别是什么，为什么没有结果 - SegmentFault 思否

ElasticSearch集群状态异常(Red、Yellow)原因分析_努力者Mr李的博客-CSDN博客_elasticsearch red

相关报错read-only / allow delete (api)：

Suppressed: org.elasticsearch.client.ResponseException: method [POST], host [http://*********:9200], URI [/button_event_index/_doc?timeout=1m], status line [HTTP/1.1 403 Forbidden]
{"error":{"root_cause":[{"type":"cluster_block_exception","reason":"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"}],"type":"cluster_block_exception","reason":"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"},"status":403}

原因：磁盘满了，ES自动成了只读

参考：Elasticsearch中FORBIDDEN/12/index read-only / allow delete (api)解决方案_程序猿微刊的博客-CSDN博客
关键命令：

#查看索引的状态
curl -XGET http://127.0.0.1:9200/button_event_index/_settings?pretty

#把索引的read_only_allow_delete重置
curl -XPUT -H "Content-Type: application/json" http://127.0.0.1:9200/button_event_index/_settings -d '{"index.blocks.read_only_allow_delete": null}'