一、Elasticsearch基本搜索语法

以下语句都基于kibana

一、索引文档

• 简单索引文档

PUT /megacorp/employee/1

PUT /索引/类型/_id     //相当于sql insert; {}中的json格式数据为源数据

语句：
PUT /megacorp/employee/1
{
    "first_name" : "John",
    "last_name" :  "Smith",
    "age" :        25,
    "about" :      "I love to go rock climbing",
    "interests": [ "sports", "music" ]
}

//再次PUT会覆盖源数据

GET /索引/类型/_id    //相当于sql selectById 

语句：
GET /megacorp/employee/1

返回值：
{
  "_index" :   "megacorp", //索引
  "_type" :    "employee", //类型
  "_id" :      "1",         //id
  "_version" : 1,           //版本
  "found" :    true,
  "_source" :  {
      "first_name" :  "John",
      "last_name" :   "Smith",
      "age" :         25,
      "about" :       "I love to go rock climbing",
      "interests":  [ "sports", "music" ]
  }
}

DELETE /megacorp/employee/1  //删除
HEAD /megacorp/employee/1    //判断是否存在

• 轻量搜索

GET /megacorp/employee/_search  //搜索所有雇员,默认返回10条数据

//查询本身赋值给参数 q=  ,查询last_name为Smith的文档
GET /megacorp/employee/_search?q=last_name:Smith 

• 使用查询表达式搜索

//该语句含义同上一个语句
GET /megacorp/employee/_search
{
    "query" : {
        "match" : {
            "last_name" : "Smith"
        }
    }
}

• 更复杂的搜索

//查询姓氏为 Smith 的员工，年龄大于 30 的
GET /megacorp/employee/_search
{
    "query" : {
        "bool": {
            "must": {
                "match" : {
                    "last_name" : "smith" 
                }
            },
            "filter": {
                "range" : {
                    "age" : { "gt" : 30 } 
                }
            }
        }
    }
}

//搜索下所有喜欢攀岩（rock climbing）的员工

GET /megacorp/employee/_search
{
    "query" : {
        "match" : {
            "about" : "rock climbing"
        }
    }
}

注：
可能返回只含有rock的文档.
Elasticsearch 默认按照相关性得分排序，即每个文档跟查询的匹配程度.

//精确匹配,仅匹配同时包含 “rock” 和 “climbing” ，并且 二者以短语 “rock climbing” 的形式紧挨着的雇员记录。
GET /megacorp/employee/_search
{
    "query" : {
        "match_phrase" : {
            "about" : "rock climbing"
        }
    }
}

二、聚合(Aggregations)

//员工中最受欢迎的兴趣爱好
GET /megacorp/employee/_search
{
  "aggs": {//固定
    "all_interests": {//自定义
      "terms": { "field": "interests" }
    }
  }
}

返回结果：
{
   ...
   "hits": { ... },//命中的数据
   "aggregations": {
      "all_interests": {//自定义字段
         "buckets": [
            {
               "key":       "music",    //分类
               "doc_count": 2           //数量
            },
            {
               "key":       "forestry",
               "doc_count": 1
            },
            {
               "key":       "sports",
               "doc_count": 1
            }
         ]
      }
   }
}

//聚合还支持分级汇总 。比如，查询特定兴趣爱好员工的平均年龄

GET /megacorp/employee/_search
{
    "aggs" : {
        "all_interests" : {
            "terms" : { "field" : "interests" },
            "aggs" : {
                "avg_age" : {
                    "avg" : { "field" : "age" }
                }
            }
        }
    }
}