Elasticsearch复合查询，排序，坐标排序，初始化mappings，Kibana Dev Tools复合查询语句

以下内容基于Elasticsearch，Kibana 6.2.4版本实践

1. 复合查询语句

• 普通条件查询

  GET clients/client/_search
  {
    "query": {
      "match": {
        "_id": 1
      }
    }
  }	
  

• 字段前缀查询

  GET clients/_search
  {
    "query": {
    	#prefix:前缀
      "prefix": {
        "column":"j"
      }
    }
  }
  

• 返回指定字段信息查询

  示例1 : 多个字段中间用逗号隔开

  GET clients/_search?_source=name,id
  {
    "query": {
      "match": {
         "_id": 1
      }
    }
  }
  

• 批量查询

  #clients索引下批量获取
  GET /clients/_mget
  {
    "docs":[
        {
        	# clients索引下的类型，可以是不同值
          "_type":"client",
          "_id":1
        },
        {
          "_type":"client2",
          "_id":2
        }
      ]
  }
  #clients索引下，相同的client类型，获取不同id值
  GET /clients/client/_mget
  {
    "docs":[
        {
          "_id":1
        },
        {
          "_id":2
        }
      ]
  }
  #批量根据id获取简写
  GET /clients/client/_mget
  {
    "ids":[1,3]
  }
  

• 混合索引查询，返回指定字段

  #从不同的索引中获取数据，并对获取的数据过滤，只取需要的字段
  GET /clients/client/_mget
  {
    "docs":[
  	    {"_index":"matthiola-log-2020-06-12","_type":"doc",
  	    		"_id":"caiXpnIBkkngFlBK72Ra","_source":["message"]},
  	    {"_id":3}
  	]
  }
  

2、排序

• 简单排序

  PUT zhifou/doc/3
  {
    "name":"龙套偏房",
    "age":22,
    "from":"gu",
    "desc":"mmp，没怎么看，不知道怎么形容",
    "tags":["造数据", "真","难"]
  }
  
  GET zhifou/doc/_search
  {
    "query": {
      "match": {
        "from": "gu"
      }
    },
    "sort": [
      {
        "age": {
          "order": "desc"
        }
      }
    ]
  }
  

• 基于多值字段排序

  #基于zhifou索引，重新put值，age值样例：[12,23]
  GET zhifou/doc/_search
  {
    "query": {
      "match_all": {}
    },
    "sort": [
      {
      
        "age": {
          "order": "asc",
          #升序的默认值，ES将按照age多字段中的最小值进行ASC升序排序
          "mode":"min"
          #“mode”:"max" 降序排序的默认值
          #avg 平均值排序
          #sum 字段总和进行排序
        }
      }
    ]
  }
  

• 空间排序(基于多值geo字段排序)

  #构建索引，type
  PUT monday_index/
  {
    "mappings":{
       "monday_type":{
          "properties": {
            "ip":{"type": "text"},
            "country":{"type": "text"},
            "loc":{"type": "geo_point"},
            "i_type":{"type": "text"}
          } 
       }
    }
  }
  #经纬坐标值插入
  PUT monday_index/monday_type/uk1
  {
    "country":"UK",
    "loc":["53.479251,-2.247926"],
    "ip":"192.168.2.244",
    "i_type":["2020-02-22","2020-06-22"]
  }
  
  PUT monday_index/monday_type/uk2
  {
    "country":"UK",
    "loc":["53.479251,-2.247926","53.96231,-1.081884"],
    "ip":"192.168.2.244",
    "i_type":["2020-02-22","2020-06-22"]
  }
  
  GET monday_index/monday_type/_search
  {
    "sort": [
      {
        "_geo_distance": {
          "loc": "51.511214,-0.119824",
          "unit": "km",
          "mode": "min"
          #平均距离值 "mode": "avg"
          #最大距离值 "mode": "max"
        }
      }
    ]
  }
  
  #返回信息中，sort返回的是坐标点距离值，具体是最大还是最小，根据mode
  "sort": [
        271.0546307824848
      ]
  

3、 索引字段属性

• 建立索引，定义mapping（字段类型）

  #首先观察一个索引长什么样，然后根据结构建立初始化mappings索引
  {
    "monday_index": {#这一级是索引名称
      "aliases": {}, #索引别名
      "mappings": { 
        "monday_type": { #type一级
          "properties": { #field字段类型在这里面
            "country": {
              "type": "text"
            },
            "i_type": {
              "type": "text"
            },
            "ip": {
              "type": "text"
            },
            "loc": {
              "type": "geo_point"
            }
          }
        }
      },
      "settings": {
        "index": {
          "creation_date": "1592796018121",
          "number_of_shards": "5",
          "number_of_replicas": "1",
          "uuid": "WQ0DViL-SA220BS5cXqswA",
          "version": {
            "created": "6020499"
          },
          "provided_name": "monday_index"
        }
      }
    }
  }
  
  #建立索引，初始化mapping设置
  PUT monday_index/
  {
    "mappings":{
       "monday_type":{
          "properties": {
            "ip":{"type": "text"},
            "country":{"type": "text"},
            "loc":{"type": "geo_point"},
            "i_type":{"type": "text"}
          } 
       }
    }
  }
  

觉得文章还行，麻烦点个赞或者评论一波呗 v^v！