elasticsearch接口创建索引 + 常用命令 + ik分词器

mappings：示例

{
	"mappings": {

		"properties": {
			"date": {
				"type": "date",
				"format": "yyyy-MM-dd HH:mm:ss"
			},
			"user_id": {
				"type": "long"
			},
			"name": {
				"type": "text",
				"fields": { 
					"keyword": {
						"ignore_above": 256,
						"type": "keyword"
					}
				}
			},
			"module": {
				"type": "text",
				"fields": {
					"keyword": {
						"ignore_above": 256,
						"type": "keyword"
					}
				}
			},
			"controller": {
				"type": "text",
				"fields": {
					"keyword": {
						"ignore_above": 256,
						"type": "keyword"
					}
				}
			},
			"method": {
				"type": "text",
				"fields": {
					"keyword": {
						"ignore_above": 256,
						"type": "keyword"
					}
				}
			},
			"ip": {
				"type": "text",
				"fields": {
					"keyword": {
						"ignore_above": 256,
						"type": "keyword"
					}
				}
			},
			"params": {
				"type": "text",
				"fields": {
					"keyword": {
						"ignore_above": 256,
						"type": "keyword"
					}
				}
			}
		}

	}
}

es常用接口：
1.查询 post host/索引名/_doc
2.新建索引 put host/索引名
3.设置字段 (ik_max_word中文分词)
PUT host/索引名/_mapping

{
  "properties": {
	"type": {
	  "type": "byte"
	},
	"works": {
	  "type": "keyword"
	},
	"title": {
	  "type": "text",
	  "analyzer": "ik_max_word",
      "search_analyzer": "ik_smart"
	},
	"content": {
	  "type": "text",
	  "analyzer": "ik_max_word",
      "search_analyzer": "ik_smart"
	},
	"gids": {
	  "type": "keyword",
	  "fields": {
			"keyword": {
				"ignore_above": 256,
				"type": "keyword"
			}
		}
	},
	"province": {
	  "type": "text",
	  "fields": {
			"keyword": {
				"ignore_above": 256,
				"type": "keyword"
			}
		}
	},
	"city": {
	  "type": "text",
	  "fields": {
			"keyword": {
				"ignore_above": 256,
				"type": "keyword"
			}
		}
	},
	"county": {
	  "type": "text",
	  "fields": {
			"keyword": {
				"ignore_above": 256,
				"type": "keyword"
			}
		}
	},
	"address": {
	  "type": "text",
	  "fields": {
			"keyword": {
				"ignore_above": 256,
				"type": "keyword"
			}
		}
	},
	"lon": {
	  "type": "double"
	},
	"lat": {
	  "type": "double"
	},
	"date": {
	  "type": "date",
	  "format": "yyyy-MM-dd HH:mm:ss"
	}
  }
}

4.更改索引

POST host/_reindex
{
  "source": {
    "index": "my_index_name"
  },
  "dest": {
    "index": "my_index_name_new"
  }
} 

5.添加文档

POST game_server_log/_doc

批量添加

POST _bulk
	{"index":{"_index":"my_store","_id":"11"}}
   {"price":10,"productID":"1111"}
   {"index":{"_index":"my_store","_id":"12"}}
   {"price":20,"productID":"1112"}

6.编辑文档

POST game_server_log/_doc/_id (必须所有字段都赋值，否则删除字段)

{
  "id":75,
  "cate" : 0,
  "aid" : "10000"
}

脚本实现字段自增

简写：
POST dev_works/_update/77
{
  "script":"ctx._source.price -=10;ctx._source.name = '程飞'"
}

完整：
POST dev_works/_update/77
{
  "script":{
    "source":"ctx._source.comments += params.count",
    "params":{
      "count": 1
    }
  }
}

7.单个删除文档

DELETE /game_server_log/_doc/_id

8.批量删除文档

POST /game_server_log/_delete_by_query
{
	"query": {
		"bool": {
			"should": [{
					"term": {
						"_id": "oShkQHUB0Zc4iCK1KlZi"
					}
				},
				{
					"term": {
						"_id": "oyhkQHUB0Zc4iCK1KlZj"
					}
				}
			]
		}
	}
}

9.聚合查询
1.计算同字段有多少种不同的类型(cardinality)

GET employee/_search
{
  "size": 0, 
  "aggs": {
    "job_category_count": {
      "cardinality": {
        "field": "job"
      }
    }
  }
}

1.2 计算同字段不同类型的数量(同查询bucket)
{
   "aggs":{
         "count":{
           "terms":{
             "field":"upid"
           }
         }
       }
}

2.基本聚合(Metrics指标查询)

max/min/avg/sum

{
    'aggs':{c
        'group_sum':{
            'sum':{
                'field':'money'
            }
        }
    }
}

{
   "aggs":{
      "avg_fees":{
      		"avg":{
      			"field":"fees"
      		}
      	}
   }
}
3.terms聚合
GET dev_work_collections/_search
{
  "size":0,//分片返回个数限制
  "aggs":{
    "total":{
      "terms":{
        "field":"wid",
        "size":10, //返回个数限制
        "order":{
          "_count": "asc" //结果排序
        }
      },
      "aggs":{  //对每个结果进行二次聚合(不常用)
        "max_wid":{
          "max":{
            "field":"wid"
          }
        }
      }
    }
  }
}

4.带过滤条件的聚合

{
  "query":{
    "bool": {
      "must":[
        {
          "term":{
            "type":0
            
          }
        },
        {
          "term":{
            "traceID":10000
          }
        }
      ]
    }
  },
  "aggs":{
        "count":{
          "terms":{
          "field":"id"
        }
        }
        
      }
  
}
5.对单个字段进行过滤后计算文档总数
GET /cars/_search?size=0
{
  "size": 0,
  "aggs" : {
    "cars" : {
      "filter" : {
        "term" : { "type" : 0   }
      }
    }
  }
}

6.同时对多个字段进行过滤计算分别文档总数
GET /cars/_search?size=0
{
  "size": 0,
  "aggs" : {
    "cars" : {
      "filters" : {
        "filters" : {
          "colorBucket" :   { "match" : { "color" : "red"   }},
          "brandBucket" : { "match" : { "brand" : "Audi" }}
        }
      }
    }
  }
}

10 .查看索引结构

GET dev_works

10 .查看mapping

GET dev_works/_mapping

备份数据库

#修改配置文件
vi config/elasticsearch.yml  path.logs下面添加一行 path.repo: /usr/local/elasticsearch/data/backup 
#添加备份仓库
curl --user elastic:password -H "Content-Type: application/json" -X PUT http://localhost:9200/_snapshot/esbackup -d'{
    "type": "fs", 
    "settings": {
        "location": "/usr/local/elasticsearch/data/backup/esbakup"
    }
}'
#备份数据
curl --user elastic:password -H "Content-Type: application/json" -X PUT http://localhost:9200/_snapshot/esbackup/snapshot_20201020?wait_for_completion=true
#查看备份信息
curl --user elastic:password -X GET "http://localhost:9200/_snapshot/esbackup/_all?pretty"
#恢复备份数据（全部）
POST /index_name/_close // 关闭（删除）索引
curl --user elastic:password -X POST http://localhost:9200/_snapshot/esbackup/snapshot_20201020/_restore?wait_for_completion=true
#恢复备份数据（部分）增加请求参数
{ 

    "indices": "index_1,index_2" 

}
#删除备份
DELETE http://127.0.0.1:9200/_snapshot/esbackup/snapshot_20201020