ElasticSearch Rest API 一文全搞定

本文通过Kibana来操作ES Rest API. ElasticSearch版本为5.2.0

知识点思维导图

基础增删改查

语法

(1) 创建/全量替换

记录不存在就是创建, 否则是全量替换.

PUT /index/type/id  
{
	"属性名" : "value"
	...
}

(2) 创建/修改

• 创建

    //如果不传id, 则系统自动生成一个UUID
    POST /index/type/
    {
    	"属性名":修改值
    }
    或者
    POST /index/type/id
    {
    	"属性名":修改值
    }
  

• 修改

    //没有带上的属性会被清除
    POST /index/type/id
    {
    	"属性名":修改值
    }
  

(3) 查询

GET /index/type/id

(4) 删除

只是逻辑删除, 将其标记为delete, 当数据越来越多时, ES会自动物理删除.

DELETE /index/type/id

实例

(1) 新增

PUT /company/employee/1
{
  "age":25,
  "salary":"20k",
  "skill":["java","mysql","es"]
}

或者

POST /company/employee
{
  "age":30,
  "salary":"30k",
  "skill":["python","redis","hadoop"]
}

POST /company/employee/2
{
  "age":22,
  "salary":"10k",
  "skill":["python","java"]
}

POST 命令新增数据时, 如果不传id, 则系统自动生成一个UUID.

(2) 查询

GET /company/employee/1

(3) 修改

POST /company/employee/1
{
  "age":40,
  "salary":"100k"
}

或

PUT /company/employee/1
{
  "age":18,
  "salary":"50K",
  "skill":["c++"]
}

PUT 是全量替换, 且是幂等操作. 上面的POST修改, skill属性被清除了, 属性现在只有age和salary.

幂等操作: GET, PUT, DELETE都是幂等操作, 执行多次与执行一次结果一样.

(4) 删除

DELETE /company/employee/1

Partial Update

部分更新.

(1) 语法

post /index/type/id/_update 
{
   "doc": {
      "属性名" : "value"
	  ...
   }
}

(2) 与全量替换和普通修改的区别

在应用程序中, 全量替换是先从ES中查询出记录, 然后在修改, 一个属性都不能少. 而部分更新就不用先从ES查询记录了, 可以直接修改, 且不用所有属性都列出.

部分更新如果只包含部分属性, 那么其他没有被包含的属性仍然存在, 但普通修改其他没有被包含的属性就直接清除了.

(3) 实例

a. 先添加一条数据

PUT /school/student/1
{
  "name": "alice",
  "age": 17
}

b. 测试部分更新

//部分更新
POST /school/student/1/_update
{
  "doc": {
    "name" : "Tom"
  }
}

//查询
GET /school/student/1

//结果
{
  "_index": "school",
  "_type": "student",
  "_id": "1",
  "_version": 7,
  "found": true,
  "_source": {
    "name": "Tom",
    "age": 17
  }
}

c. 测试普通修改

//普通修改
POST /school/student/1
{
  "name" : "Linda"
}

//查询
GET school/student/1

//结果
{
  "_index": "school",
  "_type": "student",
  "_id": "1",
  "_version": 8,
  "found": true,
  "_source": {
    "name": "Linda"
  }
}

Bulk Operation

批量查询和批量增删改的语法不同, 所以分开来介绍.

批量查询

GET /_mget
{
  "docs" : [
    {
      "_index" : "company",
      "_type" : "employee",
      "_id" : 1
    },
     {
      "_index" : "company",
      "_type" : "employee",
      "_id" : 2
    }
  ]
}

GET /company/_mget
{
  "docs" : [
    {
      "_type" : "employee",
      "_id" : 1
    },
     {
      "_type" : "employee",
      "_id" : 2
    }
  ]
}

GET /company/employee/_mget
{
  "ids" : [1,2]
}

批量增删改

(1) 语法

每一个操作要两个json串，语法如下：

POST /index/type/_bulk
{"action": {"metadata"}}
{"data"}

index和type可以放入metadata中. 每个json串不能换行, 只能放一行. 同时一个json串和一个json串之间, 必须有一个换行.

(2) action类型

• delete

  删除.

• create

  强制创建. PUT /index/type/id/_create

• index

  创建或替换.

• update

  属于部分更新.

(3) 实例

POST /_bulk
{"delete" : {"_index":"company", "_type":"employee","_id":"1"}}
{"create" :{"_index":"company","_type":"employee","_id":"2"}}
{"name":"tyshawn", "age":18}
{"index":{"_index":"company","_type":"employee","_id":"3"}}
{"name":"lee", "age":24}
{"update":{"_index":"company","_type":"employee","_id":"2"}}
{"doc":{"age":30}}

搜索

添加搜索实例数据.

PUT /website/article/1
{
  "post_date": "2017-01-01",
  "title": "my first article",
  "content": "this is my first article in this website",
  "author_id": 11401,
  "tags": [
      "java",
      "c"
    ]
}

PUT /website/article/2
{
  "post_date": "2017-01-02",
  "title": "my second article",
  "content": "this is my second article in this website",
  "author_id": 11402,
  "tags": [
      "redis",
      "linux"
    ]
}

PUT /website/article/3
{
  "post_date": "2017-01-03",
  "title": "my third article",
  "content": "this is my third article in this website",
  "author_id": 11403,
  "tags": [
      "elaticsearch",
      "kafka"
    ]
}

mapping结构如下:

GET /website/_mapping/article

{
  "website": {
    "mappings": {
      "article": {
        "properties": {
          "author_id": {
            "type": "long"
          },
          "content": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "post_date": {
            "type": "date"
          },
          "tags": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "title": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      }
    }
  }
}

当type = text时, ES默认会设置两个field, 一个分词, 一个不分词. 如content会分词, 而content.keyword不分词, content.keyword最多保留256个字符.

通用语法

(1) 搜索所有index数据.

GET /_search

(2) 搜索指定index, type下的数据(index和type可以有多个)

GET /index1/_search
GET /index1,index2/_search
GET /index1/type1/_search
GET /index1/type1,type2/_search
GET /index1,index2/type1,type2/_search

(3) 搜索所有index下的指定type的数据.

GET /_all/employee,product/_search

下面再介绍Elasticsearch搜索的条件语法.

query string search

这个查询就类似于HTTP里的GET请求, 参数放在URL上.

(1) 语法

GET /index/type/_search