kiban操作指令汇总

一、节点+索引指令

1. 查看节点

GET _cat/nodes

2. 查看节点状态

GET /_cat/health?v

3. 查看节点列表

GET /_cat/nodes?v

4. 查看所有索引

GET /_cat/indices
GET /_cat/indices?v

5. 查询所有索引的总记录数

GET _search
{
  "query": {
    "match_all":{}
  }
}

6. 创建索引

ps：索引名字后面必须换行

PUT test_index
{
"settings":{
"number_of_shards":2,
"number_of_replicas" : 1
  }
}

7. 修改索引

ps：分片不能修改，副本可以修改

PUT test_index/_settings
{
"number_of_replicas" : 2
}

8. 创建索引指定类型

PUT /index_test2
{
  "mappings": {
      "properties": {
        "id":{
          "type": "long"
        },
        "name":{
          "type": "text"
        }
      }
    }
}

9. 索引添加字段

PUT /index_test2/_mapping
{
    "properties": {
      "age":{
        "type": "long"
      }
    }
}

10. 删除索引

DELETE test_index

二、Document指令

1. 查询索引底下所有数据

GET /index_test/_search

GET index_test/_search
{
"query" : { 
  "match_all":{}
  }
}

2. 根据id查询

GET /index_test/_doc/1

3. 批量查询

get index_test/_mget
{
"docs":[
  {
    "_id":1
  },
  {
    "_id":2
  }
]}

4. 按照关键字查询

GET /index_test/_search
{
  "query": {
    "match": {
      "address": "宫"
    }
  }
}

5. 按照分词子属性查询

put index_test1/_create/1
{
"address":{
  "t1":"女孩",
  "age":18
},
"count":1
}

GET /index_test1/_search
{
  "query": {
    "match": {
      "address.t1": "女孩"
    }
  }
}

6. 按照短语查询

GET /index_test/_search
{
  "query": {
    "match_phrase": {
      "address": "天宫院"
    }
  }
}

7. 范围查询

GET index_test/_search
{
  "query": {
    "bool": {
      "filter": {
        "range": {
          "count": {
            "gt":0,
            "lt": 2
          }
        }
      }
    }
  }
}

8. 根据时间范围查询

PUT /index_test3
{
  "mappings": {
      "properties": {
        "id":{
          "type": "long"
        },
        "time":{
          "type": "date",
          "format":"yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis"
        }
      }
    }
}

插入数据，自己修改id和时间多插入几条

put index_test3/_doc/5
{
"id":5,
"time":"2022/07/12 23:59:59"
}

查询

GET index_test3/_search
{
  "size": 10, 
  "query": {
    "range": {
      "time": {
        "gte": "2022/08/14 09:37:00",
        "lte": "2022/12/14 09:40:00"
      }
    }
  }
}

9. 复合条件查询

GET index_test/_search
{
  "query": {
    "bool": {
      "must": [
        {"match": {"address": "天宫院"}},
        {"match": { "count": "2"}}]

    }
  }
}

GET index_test/_search
{
  "query": {
    "bool": {
      "should": [
        { "bool": {
          "must": [
            {"match": {"address": "天宫院"}},
            {"match": { "count": "2"}}
            ]
        }},
        { "bool": {
          "must": [
            {"match": {"address": "天宫院"}},
            {"match": { "count": "1"}}
            ]
        }}
      ]
    }
  }
}

10. 模糊查询

ps：校正匹配分词，当一个单词都无法准确匹配，es 通过一种算法对非常接近的单词也给与一定的评分，能够查询出来，但是消耗更多的性能。

GET /index_test/_search
{
  "query": {
    "fuzzy": {
      "name": "天"
    }
  }
}

11. 查询后过滤

GET /index_test/_search
{
  "query": {
    "match": {
      "address": "天宫院"
    }
  },
  "post_filter": {
    "term": {
      "count": "2"
    }
  }
}

12. 查询前过滤(推荐使用)

ps：分词器过滤在match里面不生效，在filter生效。比如这里filter的name属性输入"李四"，查不出"李四"的数据。但是输入"李"，就可以查出"李四"的数据。因为"李四"分词后，不存在"李四"这个词。

GET index_test/_search
{
  "query": {
    "bool": {
      "filter": [
        {"term": 
          {"name": "李"}
        },
        {
          "term":
            {"count": 2}
        }
      ],
      "must": 
        {"match": {
          "address": "天宫院"
        }}
    }
  }
}

13. 查询排序

GET index_test/_search
{
  "query":{
    "match": {"address":"天宫院"}
  }
  , 
  "sort": [
  	{
      "count": {
        "order": "desc"
      }
    }
  ]
}

14. 分页查询

GET index_test/_search
{
  "query": { "match_all": {} },
  "from": 0,
  "size": 2
}

15. 查询指定字段

GET index_test/_search
{
  "query": { "match_all": {} },
  "_source": ["address", "count"]
}

16. 查看聚合数据（即分组）

GET index_test/_search
{
  "aggs": {
    "groupby_actor": {
      "terms": {
        "field": "count"
      }
    }
  }
}

17. 查询聚合数据并且排序

GET index_test/_search
{ 
  "aggs": {
    "groupby_actor_id": {
      "terms": {
        "field": "count" ,
        "order": {
          "avg_score": "asc"
          }
      },
      "aggs": {
        "avg_score":{
          "avg": {
            "field": "count" 
          }
        }
       }
    } 
  }
}

18. 强制新增Document

ps：如果已存在id则报错（新增Document的时候，如果index不存在，则自动新增，副本和分片都为1）

put index_test/_create/4
{
"address":"天宫院",
"count":2
}

19. 新增/修改Document

ps：修改时候为全量替换

put index_test/_doc/1
{
"name":"李四",
"address":"北京亦庄"
}

20. 修改Document

ps：修改时候只修改部分

POST /index_test/_doc/1/_update
{
  "doc": {
    "name":"李四111"
  }
}

21. 删除Document

DELETE /index_test/_doc/1

22. 测试默认分词器

GET index_test/_analyze
{  
  "text": "我是中国人"
}

23. ik分词器

GET index_test/_analyze
{  
  "analyzer": "ik_smart", 
  "text": "我是中国人"
}

GET index_test/_analyze
{  
  "analyzer": "ik_max_word", 
  "text": "我是中国人"
}

24. 修改ik分词器词典

vi /home/es/elasticsearch-7.6.2/plugins/analysis-ik/config/extra_main.dic

25. 查看mapping

ps：同一个属性，第一次用了什么类型，后面默认就什么类型，其他类型会报错

GET index_test/_mapping

26. 高亮设置

GET index_test/_search
{
  "query": {
    "bool": {
      "must": [
        {"match": {"address": "天宫院"}},
        {"match": { "count": "2"}}]

    }
  },
  "highlight":{
  "fields": {
    "address":{
      "fragment_size": 1,
      "number_of_fragments" : 1
      }
    },
  "pre_tags":"<span style='color:red'>",
  "post_tags": "</span>"
  }
}

27. like查询

GET index_test/_search
{
  "query": {
    "wildcard": {
      "message.keyword": "*hadoop*"
    }
  }
}

28. 先group（聚合），再求数量

GET /index_test/_search
{
  "size": 0,
  "aggs": {
    "group_by_field": {
      "terms": {
        "field": "agent.hostname.keyword",
        "size": 10
      },
      "aggs": {
        "unique_count": {
          "cardinality": {
            "field": "agent.hostname.keyword"
          }
        }
      }
    }
  }
}

29. 先group（多字段聚合），再求数量

GET /index_test/_search
{
  "size": 0,
  "aggs": {
    "group_by_field": {
      "terms": {
        "field": "application",
        "size": 100
      },
      "aggs": {
        "group_by_field": {
          "terms": {
            "field": "name",
            "size": 100
          }
        }
      }
    }
  }
}