ES2-文档

1.新建文档

文档存储路径:index/type/id

指定ID新增文档

PUT sfpay_log/waf/1
{
  
  "eventName":"数据库,软件,引用 测试",
  "title":"this is a test",
  "device":"0001"
}

添加结果:创建成功

{
  "_index": "sfpay_log",
  "_type": "waf",
  "_id": "1",
  "_version": 1,
  "result": "created",
  "_shards": {
    "total": 2,
    "successful": 2,
    "failed": 0
  },
  "_seq_no": 0,
  "_primary_term": 1
}

上一个用put创建文档,还可以用post创建文档

POST sfpay_log/waf/2
{
  
  "eventName":"软件测试 ",
  "title":"this is three a test",
  "device":"0011"
}

同样可以创建成功

{
  "_index": "sfpay_log",
  "_type": "waf",
  "_id": "2",
  "_version": 1,
  "result": "created",
  "_shards": {
    "total": 2,
    "successful": 2,
    "failed": 0
  },
  "_seq_no": 0,
  "_primary_term": 1
}

未指定文档ID时,ElasticSearch会自动为文档随机生成ID

POST sfpay_log/waf
{
  
  "eventName":"数据库测试 ",
  "title":"this is also a test",
  "device":"0002"
}

添加结果:

{
  "_index": "sfpay_log",
  "_type": "waf",
  "_id": "vpnbQWQB9Qq65NE64VPc",
  "_version": 1,
  "result": "created",
  "_shards": {
    "total": 2,
    "successful": 2,
    "failed": 0
  },
  "_seq_no": 2,
  "_primary_term": 1
}

这里我们说一下put和post的区别

POST /uri 创建
DELETE /uri/xxx 删除
PUT /uri/xxx 更新或创建
GET /uri/xxx 查看

post不用加具体的id,它是作用在一个集合资源之上的(/uri),而PUT操作是作用在一个具体资源之上的(/uri/xxx)。

在ES中,如果不确定document的ID(documents具体含义见下),那么直接POST对应uri( “POST /website/blog” ),ES可以自己生成不会发生碰撞的UUID;

如果确定document的ID,比如 “PUT /website/blog/123”,那么执行创建或修改(修改时_version版本号提高1) 

2.获取文档

查询指定id文档数据

GET sfpay_log/waf/1

查询结果

{
  "_index": "sfpay_log",
  "_type": "waf",
  "_id": "1",
  "_version": 2,
  "found": true,
  "_source": {
    "eventName": "数据库,软件,引用 测试",
    "title": "this is a test",
    "device": "0001"
  }
}

同样如果我们查询一个不存在的文档:sfpay_log/waf/100,返回结果

{
  "_index": "sfpay_log",
  "_type": "waf",
  "_id": "100",
  "found": false
}

检查文档是否存在使用:HEAD

HEAD sfpay_log/waf/1

返回状态码:

200 - OK

如果检查的文档不存在:sfpay_log/waf/100

404 - Not Found

3.多文档获取multi get

mget多文档查询可以设置多个文档的查询条

GET /_mget
{
  "docs": [
    {
      "_index": "sfpay_log",
      "_type": "waf",
      "_id": "1"
    },
    {
      "_index": "sfpay_log",
      "_type": "waf",
      "_id": "2"
    }
  ]
}

如上面条件有相同的”_index“,可以将“_index”提取到路径中。

GET sfpay_log/_mget
{
  "docs": [
    {
      "_type": "waf",
      "_id": "1"
    },
    {
      "_type": "waf",
      "_id": "2"
    }
  ]
}

同样的“_type”同样可以提取到路径中。

GET sfpay_log/waf/_mget
{
  "docs": [
    {
      "_id": "1"
    },
    {
      "_id": "2"
    }
  ]
}

如果索引和类型都放在查询URL中,那么字段ID就可以放在一个数组中

GET sfpay_log/waf/_mget
{
  "ids":["1","2"]
}

其中“_type”为可选条件字段

GET sfpay_log/_mget
{
  "ids":["1","2"]
}

上面执行结果均为:

{
  "docs": [
    {
      "_index": "sfpay_log",
      "_type": "waf",
      "_id": "1",
      "_version": 1,
      "found": true,
      "_source": {
        "eventName": "数据库,软件,引用 测试",
        "title": "this is a test",
        "device": "0001"
      }
    },
    {
      "_index": "sfpay_log",
      "_type": "waf",
      "_id": "2",
      "_version": 1,
      "found": true,
      "_source": {
        "eventName": "软件测试 ",
        "title": "this is three a test",
        "device": "0011"
      }
    }
  ]
}

4.文档搜索

这里只介绍简单文档搜索

1.检索全部文档

GET sfpay_log/_search
{
  "took": 7,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 4,
    "max_score": 1,
    "hits": [
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "_yoXRGQBt6c7eh0rEdv2",
        "_score": 1,
        "_source": {
          "eventName": "数据库测试 ",
          "title": "this is also a test",
          "device": "0002"
        }
      },
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "2",
        "_score": 1,
        "_source": {
          "eventName": "软件测试 ",
          "title": "this is three a test",
          "device": "0011"
        }
      },
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "1",
        "_score": 1,
        "_source": {
          "eventName": "数据库,软件,引用 测试",
          "title": "this is a test",
          "device": "0001"
        }
      },
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "_ipVQWQBt6c7eh0rKtu9",
        "_score": 1,
        "_routing": "lc",
        "_source": {
          "title": "多次查询数据",
          "desc": "this is test",
          "device": "0001"
        }
      }
    ]
  }
}

2.term查询

term用于查询指定字段中包含指定分词的文档,只有查询分词和文档字段中的分词精确匹配时才能被检索到该文档。

GET sfpay_log/_search
{
  "query": {
    "term": {
      "eventName": {
        "value": "软"
      }
    }
  }
}

由于这里我们没有用IK中文分词,每个汉字被看做独立的一个词。查询结果

{
  "took": 3,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 0.2876821,
    "hits": [
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "2",
        "_score": 0.2876821,
        "_source": {
          "eventName": "软件测试 ",
          "title": "this is three a test",
          "device": "0011"
        }
      },
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "1",
        "_score": 0.2876821,
        "_source": {
          "eventName": "数据库,软件,引用 测试",
          "title": "this is a test",
          "device": "0001"
        }
      }
    ]
  }
}

3.terms查询

查询某个字段包含多个值时的搜索

GET sfpay_log/_search
{
  "query": {
    "terms": {
      "title": [
        "this",
        "test"
      ]
    }
  }
}

这里搜索“title”及包含“this”又包含“test”。

{
  "took": 14,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 3,
    "max_score": 1,
    "hits": [
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "_yoXRGQBt6c7eh0rEdv2",
        "_score": 1,
        "_source": {
          "eventName": "数据库测试 ",
          "title": "this is also a test",
          "device": "0002"
        }
      },
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "2",
        "_score": 1,
        "_source": {
          "eventName": "软件测试 ",
          "title": "this is three a test",
          "device": "0011"
        }
      },
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "1",
        "_score": 1,
        "_source": {
          "eventName": "数据库,软件,引用 测试",
          "title": "this is a test",
          "device": "0001"
        }
      }
    ]
  }
}

4.match查询

与term精确查询不同,对于match查询,只要被查询字段中存在任何一个词项被匹配,就会搜索到该文档。

GET sfpay_log/_search
{
  "query": {
    "match": {
      "eventName": "软测"
    }
  }
}

查询结果显示只要“eventName”字段中包含“软测”中的任何部分都会被搜索出来,”__score“作为匹配的得分,得分越高也就是匹配程度越高,排名越前。

{
  "took": 3,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 3,
    "max_score": 0.5753642,
    "hits": [
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "2",
        "_score": 0.5753642,
        "_source": {
          "eventName": "软件测试 ",
          "title": "this is three a test",
          "device": "0011"
        }
      },
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "1",
        "_score": 0.5753642,
        "_source": {
          "eventName": "数据库,软件,引用 测试",
          "title": "this is a test",
          "device": "0001"
        }
      },
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "_yoXRGQBt6c7eh0rEdv2",
        "_score": 0.2876821,
        "_source": {
          "eventName": "数据库测试 ",
          "title": "this is also a test",
          "device": "0002"
        }
      }
    ]
  }
}

5.更新文档

在ElasticSearch中文档数据是不能被改变的。如果我们要修改文档,实际上是ElasticSearch为我们新建了更高版本的文档替换原来版本文档。

1.更新数据

POST sfpay_log/waf/1
{
  "eventName": "操作系统测试攻击",
  "title": "this is a test",
  "device": "0001"
}

更新成功时ElasticSearch为我们创建了”_version“为2版本的一个新文档。

{
  "_index": "sfpay_log",
  "_type": "waf",
  "_id": "1",
  "_version": 2,
  "result": "updated",
  "_shards": {
    "total": 2,
    "successful": 2,
    "failed": 0
  },
  "_seq_no": 1,
  "_primary_term": 2
}

注意:

  • 版本加1。
  • created标识为 false,因为同索引同类型下已经存在同ID的文档。
  • 在ES内部,_version为1的文件已经被标记“删除”,并添加了一个完整的新文档。旧文档不会立即消失,但是不能再访问它。

我们查询刚才修改的文档

GET sfpay_log/waf/1

结果为被更新之后的文档

{
  "_index": "sfpay_log",
  "_type": "waf",
  "_id": "1",
  "_version": 2,
  "found": true,
  "_source": {
    "eventName": "操作系统测试攻击",
    "title": "this is a test",
    "device": "0001"
  }
}

2.更新字段

使用脚本更新文档,脚本可以在 update API中用来改变 _source 的字段内容, 它在更新脚本中称为 ctx._source 。(同样适用_type,_index,_id,_version)

POST sfpay_log/waf/1/_update
{
  "script": {
    "source":"ctx._source.device=\"0002\""
  }
}

执行更新成功

{
  "_index": "sfpay_log",
  "_type": "waf",
  "_id": "1",
  "_version": 3,
  "result": "updated",
  "_shards": {
    "total": 2,
    "successful": 2,
    "failed": 0
  },
  "_seq_no": 2,
  "_primary_term": 3
}

执行查询:GET sfpay_log/waf/1,可以获取执行更新后的文档。

{
  "_index": "sfpay_log",
  "_type": "waf",
  "_id": "1",
  "_version": 3,
  "found": true,
  "_source": {
    "eventName": "操作系统测试攻击",
    "title": "this is a test",
    "device": "0002"
  }
}

3.添加字段

同样操作,当更新的字段不存在时,添加该字段。下面执行添加phone字段

POST sfpay_log/waf/1/_update
{
  "script": {
    "source":"ctx._source.phone=\"199006006006\""
  }
}

更新成功

{
  "_index": "sfpay_log",
  "_type": "waf",
  "_id": "1",
  "_version": 4,
  "result": "updated",
  "_shards": {
    "total": 2,
    "successful": 2,
    "failed": 0
  },
  "_seq_no": 3,
  "_primary_term": 3
}

再次查询获取该文档“phone”字段已经添加成功

{
  "_index": "sfpay_log",
  "_type": "waf",
  "_id": "1",
  "_version": 4,
  "found": true,
  "_source": {
    "eventName": "操作系统测试攻击",
    "title": "this is a test",
    "device": "0002",
    "phone": "199006006006"
  }
}

4.查询更新(批量更新)

我们也可以在script语句时把source中的更新数据定义成参数形式,然后再后面的params中定义该参数的具体数值。

根据查询条件更新符合查询条件的所有文档。如下更新精确匹配“eventName”字段分词有“测”的所有文档。

POST sfpay_log/waf/1/_update
{
  "script": {
    "source": "ctx._source.phone=params.phone",
    "params": {
      "phone": "188199199199"
    }
  },
  "query": {"term": {
    "eventName": {
      "value": "测"
    }
  }}
}

执行结果显示,有3个更新成功

{
  "took": 46,
  "timed_out": false,
  "total": 3,
  "updated": 3,
  "deleted": 0,
  "batches": 1,
  "version_conflicts": 0,
  "noops": 0,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "requests_per_second": -1,
  "throttled_until_millis": 0,
  "failures": []
}

执行之后通过更新语句中的查询条件,可以获取到被更新的文档

GET sfpay_log/_search
{
  "query": {
    "term": {
      "eventName": {
        "value": "测"
      }
    }
  }
}

获取到被更新所有文档

{
  "took": 5,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 3,
    "max_score": 0.2876821,
    "hits": [
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "_yoXRGQBt6c7eh0rEdv2",
        "_score": 0.2876821,
        "_source": {
          "phone": "188199199199",
          "eventName": "数据库测试 ",
          "title": "this is also a test",
          "device": "0002"
        }
      },
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "2",
        "_score": 0.2876821,
        "_source": {
          "phone": "188199199199",
          "eventName": "软件测试 ",
          "title": "this is three a test",
          "device": "0011"
        }
      },
      {
        "_index": "sfpay_log",
        "_type": "waf",
        "_id": "1",
        "_score": 0.2876821,
        "_source": {
          "phone": "188199199199",
          "eventName": "操作系统测试攻击",
          "title": "this is a test",
          "device": "0002"
        }
      }
    ]
  }
}

6.删除文档

通过DELETE index/type/id 我们可以直接删除指定文档

删除id为:_ipVQWQBt6c7eh0rKtu9的文档

DELETE sfpay_log/waf/_ipVQWQBt6c7eh0rKtu9

执行结果

{
  "_index": "sfpay_log",
  "_type": "waf",
  "_id": "_ipVQWQBt6c7eh0rKtu9",
  "_version": 1,
  "result": "not_found",
  "_shards": {
    "total": 2,
    "successful": 2,
    "failed": 0
  },
  "_seq_no": 9,
  "_primary_term": 3
}

 

 

转载于:https://my.oschina.net/u/3100849/blog/1836729

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
完整版:https://download.csdn.net/download/qq_27595745/89522468 【课程大纲】 1-1 什么是java 1-2 认识java语言 1-3 java平台的体系结构 1-4 java SE环境安装和配置 2-1 java程序简介 2-2 计算机中的程序 2-3 java程序 2-4 java类库组织结构和文档 2-5 java虚拟机简介 2-6 java的垃圾回收器 2-7 java上机练习 3-1 java语言基础入门 3-2 数据的分类 3-3 标识符、关键字和常量 3-4 运算符 3-5 表达式 3-6 顺序结构和选择结构 3-7 循环语句 3-8 跳转语句 3-9 MyEclipse工具介绍 3-10 java基础知识章节练习 4-1 一维数组 4-2 数组应用 4-3 多维数组 4-4 排序算法 4-5 增强for循环 4-6 数组和排序算法章节练习 5-0 抽象和封装 5-1 面向过程的设计思想 5-2 面向对象的设计思想 5-3 抽象 5-4 封装 5-5 属性 5-6 方法的定义 5-7 this关键字 5-8 javaBean 5-9 包 package 5-10 抽象和封装章节练习 6-0 继承和多态 6-1 继承 6-2 object类 6-3 多态 6-4 访问修饰符 6-5 static修饰符 6-6 final修饰符 6-7 abstract修饰符 6-8 接口 6-9 继承和多态 章节练习 7-1 面向对象的分析与设计简介 7-2 对象模型建立 7-3 类之间的关系 7-4 软件的可维护与复用设计原则 7-5 面向对象的设计与分析 章节练习 8-1 内部类与包装器 8-2 对象包装器 8-3 装箱和拆箱 8-4 练习题 9-1 常用类介绍 9-2 StringBuffer和String Builder类 9-3 Rintime类的使用 9-4 日期类简介 9-5 java程序国际化的实现 9-6 Random类和Math类 9-7 枚举 9-8 练习题 10-1 java异常处理 10-2 认识异常 10-3 使用try和catch捕获异常 10-4 使用throw和throws引发异常 10-5 finally关键字 10-6 getMessage和printStackTrace方法 10-7 异常分类 10-8 自定义异常类 10-9 练习题 11-1 Java集合框架和泛型机制 11-2 Collection接口 11-3 Set接口实现类 11-4 List接口实现类 11-5 Map接口 11-6 Collections类 11-7 泛型概述 11-8 练习题 12-1 多线程 12-2 线程的生命周期 12-3 线程的调度和优先级 12-4 线程的同步 12-5 集合类的同步问题 12-6 用Timer类调度任务 12-7 练习题 13-1 Java IO 13-2 Java IO原理 13-3 流类的结构 13-4 文件流 13-5 缓冲流 13-6 转换流 13-7 数据流 13-8 打印流 13-9 对象流 13-10 随机存取文件流 13-11 zip文件流 13-12 练习题 14-1 图形用户界面设计 14-2 事件处理机制 14-3 AWT常用组件 14-4 swing简介 14-5 可视化开发swing组件 14-6 声音的播放和处理 14-7 2D图形的绘制 14-8 练习题 15-1 反射 15-2 使用Java反射机制 15-3 反射与动态代理 15-4 练习题 16-1 Java标注 16-2 JDK内置的基本标注类型 16-3 自定义标注类型 16-4 对标注进行标注 16-5 利用反射获取标注信息 16-6 练习题 17-1 顶目实战1-单机版五子棋游戏 17-2 总体设计 17-3 代码实现 17-4 程序的运行与发布 17-5 手动生成可执行JAR文件 17-6 练习题 18-1 Java数据库编程 18-2 JDBC类和接口 18-3 JDBC操作SQL 18-4 JDBC基本示例 18-5 JDBC应用示例 18-6 练习题 19-1 。。。

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值