Elasticsearch语法大全

Elasticsearch语法大全

安装教程跳过，此文档是基于kibana操作Elasticsearch

一、 ElasticSearch 创建index、type、field语法

1、Elasticsearch和关系型数据库数据模型对应关系表

2、创建索引并查看

PUT /deocde
GET /_cat/indices?v

3、删除索引并查看

DELETE /decode
GET /_cat/indices?v

4、文档操作

4.1、查看文档类型

GET /decode/resolve/_mapping

4.2、在索引中添加文档

PUT /decode/resolve/1
{
  "vin": "B1293049555"
}

4.3、在索引中查看文档

GET /decode/resolve/1

4.4、在索引中修改文档

POST /decode/resolve/1/_update
{
  "doc": { "vin": "A1299405555" }
}

4.5、在索引中删除文档

DELETE /decode/reslove/1

4.6、在索引中批量操作文档

POST /decode/resolve/_bulk
{"index":{"_id":"1"}}
{"vin": "D1445266366" }
{"index":{"_id":"2"}}
{"vin": "C4526365588" }

5、创建一个数据模型样例（包含index、type、field）：

PUT /decode
{
    "settings":{
        "index":{
            "number_of_shards":3,
            "number_of_replicas":0
        }
    },
    "mappings":{
        "resolve":{
            "properties":{
                "id":{
                    "type":"keyword"
                },
                "vin":{
                    "type":"keyword"
                },
                "gender":{
                    "type":"keyword"
                },
                "carBrandId":{
                    "type":"text"
                },
                "balance":{
                    "type":"int"
                },
                "age":{
                    "type":"int"
                },
                "address":{
                    "type":"keyword"
                },
                "craeteTime":{
                    "type":"date"
                },
                "statusId":{
                    "type":"keyword"
                },
                "enable":{
                    "type":"boolean"
                }
            }
        }
    }
}

6、Elasticsearch给type增加一项field

PUT es服务ip地址:9200/index_name/_mapping

PUT decode/_mapping
{
 "properties": {
   "fieldName":{
     "type":"boolean"
   }
 }
}

二、Elasticsearch搜索语句

1、最简单的搜索，使用match_all来表示，例如搜索全部

GET /decode/resolve/_search
{
  "query": { "match_all": {} }
}

2、分页搜索，from表示偏移量，从0开始，size表示每页显示的数量

GET /decode/resolve/_search
{
  "query": { "match_all": {} },
  "from": 0,
  "size": 10
}

3、搜索排序，使用sort表示，例如按createTime字段降序排列

GET /decode/resolve/_search
{
  "query": { "match_all": {} },
  "sort": { "createTime": { "order": "desc" } }
}

4、搜索并返回指定字段内容，使用_source表示，例如只返回id和createTime两个字段内容

GET /decode/resolve/_search
{
  "query": { "match_all": {} },
  "_source": ["id", "createTime"]
}

5、条件搜索，使用match表示匹配条件，例如搜索出id为20的文档：

GET /decode/resolve/_search
{
  "query": {
    "match": {
      "id": 20
    }
  }
}

6、文本类型字段的条件搜索，例如搜索address字段中包含mill的文档，对比上一条搜索可以发现，对于数值类型match操作使用的是精确匹配，对于文本类型使用的是模糊匹配；

GET /decode/resolve/_search
{
  "query": {
    "match": {
      "address": "mill"
    }
  },
  "_source": [
    "address",
    "id"
  ]
}

7、短语匹配搜索，使用match_phrase表示，例如搜索address字段中同时包含mill和lane的文档：

GET /decode/resolve/_search
{
  "query": {
    "match_phrase": {
      "address": "mill lane"
    }
  }
}

8、组合搜索，使用bool来进行组合，must表示同时满足，例如搜索address字段中同时包含mill和lane的文档

GET /decode/resolve/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "address": "mill" } },
        { "match": { "address": "lane" } }
      ]
    }
  }
}

9、组合搜索，should表示满足其中任意一个，搜索address字段中包含mill或者lane的文档

GET /decode/resolve/_search
{
  "query": {
    "bool": {
      "should": [
        { "match": { "address": "mill" } },
        { "match": { "address": "lane" } }
      ]
    }
  }
}

10、组合搜索，must_not表示同时不满足，例如搜索address字段中不包含mill且不包含lane的文档

GET /decode/resolve/_search
{
  "query": {
    "bool": {
      "must_not": [
        { "match": { "address": "mill" } },
        { "match": { "address": "lane" } }
      ]
    }
  }
}

11、组合搜索，组合must和must_not，例如搜索age字段等于40且state字段不包含ID的文档

GET /decode/resolve/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "age": "40" } }
      ],
      "must_not": [
        { "match": { "state": "ID" } }
      ]
    }
  }
}

12、搜索过滤，使用filter来表示，例如过滤出balance字段在20000~30000的文档

GET /decode/resolve/_search
{
  "query": {
    "bool": {
      "must": { "match_all": {} },
      "filter": {
        "range": {
          "balance": {
            "gte": 20000,
            "lte": 30000
          }
        }
      }
    }
  }
}

13、对搜索结果进行聚合，使用aggs来表示，类似于MySql中的group by，例如对vin字段进行聚合，统计出相同state的文档数量

GET /decode/resolve/_search
{
  "size": 0,
  "aggs": {
    "group_by_vin": {
      "terms": {
        "field": "vin.keyword"
      }
    }
  }
}

14、嵌套聚合，例如对state字段进行聚合，统计出相同vin的文档数量，再统计出balance的平均值

GET /decode/resolve/_search
{
  "size": 0,
  "aggs": {
    "group_by_vin": {
      "terms": {
        "field": "vin.keyword"
      },
      "aggs": {
        "average_balance": {
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  }
}

15、对聚合搜索的结果进行排序，例如按balance的平均值降序排列

GET /decode/resolve/_search
{
  "size": 0,
  "aggs": {
    "group_by_vin": {
      "terms": {
        "field": "vin.keyword",
        "order": {
          "average_balance": "desc"
        }
      },
      "aggs": {
        "average_balance": {
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  }
}

16、按字段值的范围进行分段聚合，例如分段范围为age字段的[20,30] [30,40] [40,50]，之后按gender统计文档个数和balance的平均值

GET /decode/resolve/_search
{
  "size": 0,
  "aggs": {
    "group_by_age": {
      "range": {
        "field": "age",
        "ranges": [
          {
            "from": 20,
            "to": 30
          },
          {
            "from": 30,
            "to": 40
          },
          {
            "from": 40,
            "to": 50
          }
        ]
      },
      "aggs": {
        "group_by_gender": {
          "terms": {
            "field": "gender.keyword"
          },
          "aggs": {
            "average_balance": {
              "avg": {
                "field": "balance"
              }
            }
          }
        }
      }
    }
  }
}