【ELK】Elasticsearch入门04 -- 基础语法 查询语法(全文检索、多字段匹配、词条匹配、模糊检索、结果过滤)

【ELK】Elasticsearch入门04 – 基础语法 查询语法(全文检索、多字段匹配、词条匹配、模糊检索、结果过滤)

 

查询所有数据

GET /索引名/_search
{
  "query" : {
    "match_all": {}
  }
}

GET /test/_search

{
  "query" : {
    "match_all": {}
  }
}

返回
{
  "took" : 0,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 1.0,
        "_source" : {
          "age" : "33"
        }
      }
    ]
  }
}

全文检索

只要分词中包含即可检索出，如下zhang er 分词为zhang和er，其中zhang与索引中数据的zhang匹配上，所以将zhang san检索出来

GET /索引名/_search
{
  "query": {
    "match": {
      "字段名": "检索值"
    }
  }
}

GET /test/_search
{
  "query": {
    "match": {
      "name": "zhang er"
    }
  }
}

返回
{
  "took" : 149,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 0.13353139,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 0.13353139,
        "_source" : {
          "name" : "zhang san",
          "age" : "23",
          "sex" : "false"
        }
      }
    ]
  }
}

如果需要所有分词都匹配才检索出结果则采用下面检索方式，如下面zhang er分词为zhang 和 er，但是索引中数据为zhang san ，只匹配上了zhang ，san未匹配中，所以未检索出数据。

GET /索引名/_search
{
  "query": {
    "match": {
      "字段名": {
      ”query“ : "检索值"，
        ## 如果需要目标内容包含检索值的所有分词，则需要设置and。默认为or
      "operator":"and"
      }
    }
  }
}

GET /test/_search
{
  "query": {
    "match": {
      "name": {
        "query": "zhang er",
         "operator":"and"
      }
    }
  }
}

返回

{
  "took" : 0,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 0.2876821,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 0.2876821,
        "_source" : {
          "name" : "zhang san",
          "age" : "23",
          "sex" : "false"
        }
      }
    ]
  }
}

多字段匹配

同一个检索值匹配多个字段

GET /索引名/_search
{
  "query":{
    "multi_match": {
      "query": "检索值",
      "fields": [“字段1”，“字段2”]
    }
  }
}

GET /test/_search
{
  "query":{
    "multi_match": {
      "query": "zhang san",
      "fields": ["name"]
    }
  }
}

返回
{
  "took" : 301,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 1.3862942,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 1.3862942,
        "_source" : {
          "name" : "zhang san",
          "age" : "22",
          "sex" : "false"
        }
      }
    ]
  }
}

词条匹配

trem 精确查询，对查询的值不分词,直接进倒排索引去匹配。这也如果索引类型为text则不一定会检索出来。因为倒排索引中text类型是分词后的数据，如果检索值不分词可以与倒排索引中分词的值匹配上则可以查出。

GET /索引值/_search
{
  "query":{
    "term": {
      "字段名": {"value" : "字段值"}
    }
  }
}

GET /test/_search
{
  "query":{
    "term": {
      "name": {"value" : "zhang san"}
    }
  }
}

返回：
{
  "took" : 0,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 0,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  }
}

GET /test/_search
{
  "query":{
    "term": {
      "name": {"value" : "zhang"}
    }
  }
}

返回：
{
  "took" : 0,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 2,
      "relation" : "eq"
    },
    "max_score" : 0.38845783,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 0.38845783,
        "_source" : {
          "name" : "zhang san",
          "age" : "22",
          "sex" : "false"
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "5",
        "_score" : 0.32969955,
        "_source" : {
          "name" : "zhang san li",
          "age" : "22",
          "sex" : "false"
        }
      }
    ]
  }
}

从上面可以看出zhang san作为一个整体去text类型字段的倒排索引中找，没有找到这个分词的记录所以没有结果。而zhang作为整体去text类型字段的倒排索引张找可以找到zhang这个分词的记录，所以将符合条件的两个结果列出。

模糊查询

当单词长度为1-2个字母时，其可编辑距离为0
当单词长度为3-5个字母时，其可编辑距离为1
当单词长度大于等于6时，其可编辑距离为2
对单词中一个字母进行增，删，改，为一个可编辑距离

GET /test/_search
{
  "query":{
    "fuzzy": {
      "字段名": {"value" : "检索值"}
    }
  }
}

如下例子，zhangsa总长度为7，那么去除sa两个字母，即两个可编辑距离，则变为zhang。那么就将zhang的记录都匹配出来了

GET /test/_search
{
  "query":{
    "fuzzy": {
      "name": {"value" : "zhangsa"}
    }
  }
}

返回：
{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 2,
      "relation" : "eq"
    },
    "max_score" : 0.29950577,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 0.29950577,
        "_source" : {
          "name" : "zhang san",
          "age" : "22",
          "sex" : "false"
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "5",
        "_score" : 0.25249034,
        "_source" : {
          "name" : "zhang san li",
          "age" : "22",
          "sex" : "false"
        }
      }
    ]
  }
}

结果过滤

表明检查结果需要返回哪些字段，未标明的不返回

显示该字段
“_source”:"字段名"
显示下面字段
“_source”:["字段名1","字段名2"]
不显示以下字段
“_source”: {"excludes":"字段名"}

GET /test/_search
{
 "_source": {"excludes":"sex"},
  "query":{
    "fuzzy": {
      "name": {"value" : "zhangsa"}
    }
  }
}

返回：
{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 2,
      "relation" : "eq"
    },
    "max_score" : 0.29950577,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 0.29950577,
        "_source" : {
          "name" : "zhang san",
          "age" : "22"
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "5",
        "_score" : 0.25249034,
        "_source" : {
          "name" : "zhang san li",
          "age" : "22"
        }
      }
    ]
  }
}