Elasticsearch6.8专题之1:Getting Started

参考

本系列专题是学习笔记，将官方文档总结凝练了一下，只列出一些重要的点。

https://www.elastic.co/guide/en/elasticsearch/reference/6.8/getting-started.html

启动并运行Elasticsearch

启动两个节点，指定不同的日志和数据目录

./elasticsearch -Epath.data=data2 -Epath.logs=log2
./elasticsearch -Epath.data=data3 -Epath.logs=log3

索引一些文件

指定docId 索引文档

curl -X PUT "localhost:9200/customer/_doc/1?pretty" -H 'Content-Type: application/json' -d'
{
  "name": "John Doe"
}'

通过docId 检索文档

curl -X GET "localhost:9200/customer/_doc/1?pretty"

批量索引文档

curl -H "Content-Type: application/json" -XPOST "localhost:9200/bank/_doc/_bulk?pretty&refresh" --data-binary "@accounts.json"

开始搜索

一些简单的搜索例子

排序

GET /bank/_search
{
  "query": { "match_all": {} },
  "sort": [
    { "account_number": "asc" }
  ]
}

es的每次搜索请求都是独立的，es不会维护任何状态信息。

查询地址中包含mill 或 lane的记录

GET /bank/_search
{
  "query": { "match": { "address": "mill lane" } }
}

如果要查询同时包含mill lane，这个是短语查询也就是目标文本需要包含mill lane的短语信息。如果目标文本是mill nsh lane，则不会匹配。

GET /bank/_search
{
  "query": { "match_phrase": { "address": "mill lane" } }
}

如果也要匹配这样的文档mill nsh lane就需要

GET /bank/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "address": "mill"
          }
        },
        {
          "match": {
            "address": "lane"
          }
        }
      ]
    }
  }
}

es默认是根据评分排序

bool 查询

bool 查询包含三个查询子句，must、should、must_not；其中must_not被当作filter处理不参与评分，must和should参与评分

使用汇总分析结果

terms 相当于sql的group by

select count(state.keyword) from bank group by state.keyword

GET /bank/_search
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword"
      }
    }
  }
}

cardinality 相当于 count(distinct email.keyword)

select count(distinct email.keyword) from bank group by state.keyword

GET /bank/_search
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword",
        "size": 100
      },
      "aggs": {
        "value": {
          "cardinality": {
            "field": "email.keyword"
          }
        }
      }
    }
  }
}

value_count 相当于count

select count(email.keyword) from bank group by state.keyword

GET /bank/_search
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword",
        "size": 100
      },
      "aggs": {
        "value": {
          "value_count": {
            "field": "email.keyword"
          }
        }
      }
    }
  }
}

select avg(balance) as value from bank group by state.keyword order by value limit 0,100

GET /bank/_search
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword",
        "size": 100,
        "order": {
          "value": "desc"
        }
      },
      "aggs": {
        "value": {
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  }
}

GET bank/_search
{
  "size": 0,
  "aggs": {
    "group_by_age": {
      "range": {
        "field": "age",
        "ranges": [
          {
            "from": 20,
            "to": 30
          },
          {
            "from": 30,
            "to": 40
          },
          {
            "from": 40,
            "to": 50
          }
        ]
      },
      "aggs": {
        "group_by_gender": {
          "terms": {
            "field": "gender.keyword"
          },
          "aggs": {
            "average_balance": {
              "avg": {
                "field": "balance"
              }
            }
          }
        }
      }
    }
  }
}