1、工具
kibana-7.2.0-windows-x86_64(汉化:kibana-7.2.0-windows-x86_64\config\kibana.yml 最后一行i18n.locale: "zh-CN")
elasticsearch-7.2.0
2、中文api
https://es.xiaoleilu.com/010_Intro/30_Tutorial_Search.html
es 索引 、type 含义用(db)数据库结构解释
Elasticsearch集群可以包含多个索引(indices)(数据库),每一个索引可以包含多个类型(types)(表),每一个类型包含多个文档(documents)(行),然后每个文档包含多个字段(Fields)(列)。
Relational DB -> Databases -> Tables -> Rows -> Columns
Elasticsearch -> Indices -> Types -> Documents -> Fields
3、插入数据
PUT /megacorp/employee/1
{
"first_name" : "John",
"last_name" : "Smith",
"age" : 25,
"about" : "I love to go rock climbing",
"interests": [ "sports", "music" ]
}
4、查询
a、简单搜索
”——索引(megacorp)、类型(employee)和ID(1)既可。根据这三部分信息,我们就可以返回原始JSON文档:
GET /megacorp/employee/1
结果:
{
"_index" : "megacorp",
"_type" : "employee",
"_id" : "1",
"_version" : 2,
"_seq_no" : 1,
"_primary_term" : 1,
"found" : true,
"_source" : {
"first_name" : "John",
"last_name" : "Smith",
"age" : 25,
"about" : "I love to go rock climbing",
"interests" : [
"sports",
"music"
]
}
}
b、搜索全部
使用megacorp
索引和employee
类型,但是我们在结尾使用关键字_search
来取代原来的文档ID。响应内容的hits
数组中包含了我们所有的三个文档。默认情况下搜索会返回前10个结果。
GET /megacorp/employee/_search
c、根据某字段搜索
我们在请求中依旧使用_search
关键字,然后将查询语句传递给参数q=
。这样就可以得到所有姓氏为Smith的结果:
GET /megacorp/employee/_search?q=last_name:Smith
d、使用DSL语句查询(结果同上)
GET /megacorp/employee/_search
{
"query" : {
"match" : {
"last_name" : "Smith"
}
}
}
e、复杂的搜索(加过滤器(filter))
大于30岁且名字为Smith的员工
GET /megacorp/employee/_search
{
"query" : {
"filtered" : {
"filter" : {
"range" : {
"age" : { "gt" : 30 } <1>
}
},
"query" : {
"match" : {
"last_name" : "smith" <2>
}
}
}
}
}
出现错误:
{
"error": {
"root_cause": [
{
"type": "parsing_exception",
"reason": "no [query] registered for [filtered]",
"line": 3,
"col": 22
}
],
"type": "parsing_exception",
"reason": "no [query] registered for [filtered]",
"line": 3,
"col": 22
},
"status": 400
}
原因和解决
原因: 过滤查询已被弃用,并在ES 5.0中删除。
解决: 使用bool / must / filter查询
GET /megacorp/employee/_search
{
"query" : {
"bool" : {
"filter" : {
"range" : {
"age" : { "gt" : 30 }
}
},
"must" : {
"match" : {
"last_name" : "smith"
}
}
}
}
}
结果:
{
"took" : 2,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 1,
"relation" : "eq"
},
"max_score" : 0.35667494,
"hits" : [
{
"_index" : "megacorp",
"_type" : "employee",
"_id" : "2",
"_score" : 0.35667494,
"_source" : {
"first_name" : "Jane",
"last_name" : "Smith",
"age" : 32,
"about" : "I like to collect rock albums",
"interests" : [
"music"
]
}
}
]
}
}
f、全文搜索
match
查询,从about
字段中搜索"rock climbing"
GET /megacorp/employee/_search
{
"query" : {
"match" : {
"about" : "rock climbing"
}
}
}
结果:
{
"took" : 8,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 2,
"relation" : "eq"
},
"max_score" : 1.0314757,
"hits" : [
{
"_index" : "megacorp",
"_type" : "employee",
"_id" : "1",
"_score" : 1.0314757,
"_source" : {
"first_name" : "John",
"last_name" : "Smith",
"age" : 25,
"about" : "I love to go rock climbing",
"interests" : [
"sports",
"music"
]
}
},
{
"_index" : "megacorp",
"_type" : "employee",
"_id" : "2",
"_score" : 0.35044178,
"_source" : {
"first_name" : "Jane",
"last_name" : "Smith",
"age" : 32,
"about" : "I like to collect rock albums",
"interests" : [
"music"
]
}
}
]
}
}
默认情况下,Elasticsearch根据结果相关性评分来对结果集进行排序,所谓的「结果相关性评分」就是文档与查询条件的匹配程度。很显然,排名第一的John Smith
的about
字段明确的写到“rock climbing”。
但是为什么Jane Smith
也会出现在结果里呢?原因是“rock”在她的abuot
字段中被提及了。因为只有“rock”被提及而“climbing”没有,所以她的_score
要低于John。
这个例子很好的解释了Elasticsearch如何在各种文本字段中进行全文搜索,并且返回相关性最大的结果集。相关性(relevance)的概念在Elasticsearch中非常重要,而这个概念在传统关系型数据库中是不可想象的,因为传统数据库对记录的查询只有匹配或者不匹配。