Elasticsearch8 常用查询

返回指定字段

xxx是event中的一个字段

GET /news/_search
{
  "query": {"match_all": {}},
  "_source": [
    "event.xxx"]
}

短语查询

_source excludes 排除返回字段，sort时间倒序排序，from size分页

GET /news/_search
{
  "query": {
    "bool": {
      "should": [
        {
          "match_phrase": {
            "title": "xxx"
          }
        },
        {
          "match_phrase": {
            "content": "xxx"
          }
        }
      ]
    }
  },
  "_source": {
    "excludes": [
      "content"
    ]
  },
  "sort": [
    {
      "news_time": {
        "order": "desc"
      }
    }
  ], 
  "from": 0,
  "size": 20
}

精确查询

单字段单值

GET /news/_search
{
  "query": {
    "constant_score": {
      "filter": {
        "term": {
          "tags.keyword": "xxx"
        }
      }
    }
  }
}

单字段多值（OR关系）

GET /news/_search
{
  "query": {
    "constant_score": {
      "filter": {
        "terms": {
          "tags.keyword": [
            "xxx",
            "yyy"
          ]
        }
      }
    }
  }
}

多字段OR

GET /news/_search
{
  "query": {
    "bool": {
      "should": [
        {
          "term": {
            "tags.keyword": "xxx"
          }
        },
        {
          "term": {
            "category.keyword": "yyy"
          }
        }
      ]
    }
  }
}

多字段AND

GET /news/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "tags.keyword": "xxx"
          }
        },
        {
          "term": {
            "category.keyword": "yyy"
          }
        }
      ]
    }
  }
}

排除指定ID

GET /news/_search
{
  "query": {
    "bool": {
      "must_not": [
        {
          "ids": {
            "values": [
              "f2t6cIEB1CYi8x_aKrHr",
              "gmuAcIEB1CYi8x_a9rFL"
            ]
          }
        }
      ],
      "should": [
        {
          "match": {
            "content": "xxx"
          }
        }
      ]
    }
  }
}

指定id

GET /news/_search
{
  "query": {
    "ids": {
      "values": [
              "l8gXzIMBXWb_zEUE3mWz",
              "g0J91oEBIb0moaJK1lY1",
              "dUJ91oEBIb0moaJKv1b4"
            ]
    }
  }
}

must中嵌套should

title中必须同时包含xxx和yyy

GET /news/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "bool": {
            "should": [
              {"match_phrase": {"title": "xxx"}}
            ]
          }
        },
        {
          "bool": {
            "should": [
              {"match_phrase": {"title": "yyy"}}
            ]
          }
        }
      ]
    }
  }
}

排序

先按照评分排序，再按照时间排序

GET /news/_search
"sort": [
    {
      "_score": {
        "order": "desc"
      }
    },
    {
      "news_time": {
        "order": "desc"
      }
    }
  ]

局部更新

doc是固定写法，labels是需要更新的字段

POST /news/_update/tEJz1oEBIb0moaJKOlLv
{
  "doc": {
    "labels": [
      "xxx",
      "yyy"
    ]
  }
}

新增并替换字段

POST /news/_update_by_query
{
    "script" : {
        "source": "ctx._source.describe = ctx._source.abstract",
        "lang": "painless"
    }
}

删除字段

POST /news/_update_by_query
{
    "script" : {
        "source": "ctx._source.remove('abstract')",
        "lang": "painless"
    }
}

按照_id排序

PUT _cluster/settings
{
  "persistent": {
    "indices.id_field_data.enabled": true
  }
}

elasticdump使用

elasticdump --input=http://xxx:9200/news --output=news.json --type=data --searchBody='{"query": {"match_all": {}}}' --fileSize=150mb --limit=1000 --sourceOnly

分组统计

GET /news/_search
{
  "aggs": {
    "group_by_tags": {
      "terms": {
        "field": "origin.keyword",
        "size": 10000
      }
    },
    "group_count":{
      "stats_bucket": {
        "buckets_path": "group_by_tags>_count"
      }
    }
  },
  "size": 0
}