es-kibana页面操作

GET /megacorp/employee/_search

GET /megacorp/employee/_search
{
“query”:{
“match”: {
“about”:“rock climbing”
}
}
}

#匹配字段 并过滤range
GET /megacorp/employee/_search
{
“query”: {
“bool”:{
“must”:{
“match”:{
“last_name”:“Smith”
}
},
“filter”:{
“range”: {
“age”: {
“gt”:30
}
}
}
}
}
}

#显示一个完整的字段
GET /megacorp/employee/_search
{
“query”: {
“match_phrase”: {
“about”: “rock climbing”
}
}
}

#高亮显示" rock climbing"
GET /megacorp/employee/1
{
“query”: {
“match_phrase”: {
“about”: “rock climbing”
}
},
“highlight”:{
“fields”: {
“about”: {}
}
}
}

GET /megacorp/employee/_search
{
“aggs”: {
“all_interests”: {
“terms”: { “field”: “interests” }
}
}
}

PUT /website/blog/1/
{
“title”:“My first blog entry”,
“text”: “Just trying this out…”
}

GET /website/blog/1?version=3
{
“title”:“My first blog entry”,
“text”: “Just trying this out…”
}

PUT my_index/
{
“mappings”: {
“my_type”:{
“properties”:{
“full_name”:{
“type”:“text”
}
}
}
}
}

GET my_index/_mapping

#在创建name的时候类型为text 同时也设置了类型keyword
#俩者的区别在于 text用于全文索引,keyword用于分析(聚合)
PUT bg063
{
“mappings”:{
“my_type”:{
“properties”:{
“name”:{
“type”:“text”,
“fields”:{
“keyword”:{
“type”:“keyword”
}
}
}
}
}
}}

GET /bg063/_mapping

PUT my_index/my_type/1
{
“region”:“us”,
“manager”:{
“age”:30,
“name”:{
“first”:“John”,
“last”:“Smith”
}
}
}

GET my_index/my_type/1

PUT my_indexxx
{
“mappings”: {
“my_type”:{
“properties”:{
“region”:{
“type”:“keyword”
},
“manager”:{
“properties”:{
“age”:{
“type”:“integer”
},“name”:{
“properties”:{
“first”:{
“type”:“text”
},
“last”:{
“type”:“text”
}}
}
}
}}}}}

PUT my_indexx

{

“mappings”: {

“my_type”: {

“properties”: {

“region”: {

“type”: “keyword”

},

“manager”: {

“properties”: {

“age”: { “type”: “integer” },

“name”: {

“properties”: {

“first”: { “type”: “text” },

“last”: { “type”: “text” }

}}}}}}}}

PUT my_index1
{
“mappings”: {
“my_type”:{
“properties”:{
“date”:{
“type”:“date”
}
}
}
}
}

GET my_index1/_mapping

PUT my_index1/my_type/1
{
“date”:“2015-01-01”
}

GET my_index1/my_type/1

PUT my_index1/my_type/2
{
“date”:“2015-01-01T12:10:30Z”
}

GET my_index1/my_type/2

PUT my_index1/my_type/3
{
“date”:“1420070400001”
}

GET my_index1/my_type/3

#日期格式会自动转化
GET my_index1/_search
{
“sort”:{
“date”:“asc”
}
}

POST my_index3/my_type
{
“mapping”:{
“my_type”:{
“properties”:{
“type”:"[]"
}
}
}
}

GET my_index3/_mapping

PUT my_indexr

{

“mappings”: {

“my_type”: {

“properties”: {

“ip_addr”: {

“type”: “ip”

}

}

}

}

}

PUT my_indexr/my_type/1
{
“ip_addr”:“192.168.1.201”
}

GET my_indexr/my_type/1

PUT my_indexr/taat/1
{
“ip_addr”:“192.168.1.202”
}

#range类型 数据库 range_index 表 my_type 字段属性expected_attendees time_frame

PUT /range_index
{
“mappings”: {
“my_type”:{
“properties”:{
“expected_attendees”:{
“type”:“integer_range”
},
“time_frame”:{
“type”:“date_range”,
“format”:“yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_millis”
}
}
}
}
}

#放入数据
PUT /range_index/my_type/1
{
“expected_attendees”:{
“gte”:0,
“lte”:30
},
“time_frame”:{
“gte” : “2015-10-31 12:00:00”,

“lte” : “2015-11-01”
}
}

#查询数据

GET /range_index/_search

#nested类型练习

#nested的出现是为了解决object的平整化问题

PUT my_index/my_type/1
{
“name”:“zhangsan”
,“froup”:“fans”
,“user”:[{
“first”:“jhon”,
“last”:“Smith”
},{
“first”:“thank”,
“last”:“you”
}
]
}

#在这种情况下会出问题 把一些不相关的结果全部匹配出来了
GET my_index/_search
{
“query”:{
“bool”:{
“must”:[
{“match”: {
“user.first”: “jhon”
}},

    {"match":{
      "user.last":"you"
    }}
  
    ]
}}

}

#解决以上方案就是用nested方法
PUT my_index6
{
“mappings”: {
“my_type”:{
“properties”:{
“user”:{
“type”:“nested”
}
}
}
}
}

#这里是nested特征
GET my_index6/_mapping

#一样像是 上面放入数据
PUT /my_index6/my_type/1
{
“user”:[
{“first”:“jhon”,
“last”:“Smith”
},{
“first”:“thank”,
“last”:“you”
}
]
}

#一样像是上面get数据
GET /my_index6/_search
{
“query”: {
“nested”:{
“path”:“user”,
“query”:{
“bool”:{
“must”:[{
“match”:
{
“first”:“jhon”
}},
{“match”:{
“last”:“you”
}}
]
}

    }
}
}

}

#analysis 解析器 默认的解析器为英文分析standard

PUT bg064/
{
“mappings”: {
“text01”:{
“properties”:{
“test”:{
“type”:“text”,
“analyzer”:“standard”
}
}
}
}
}

GET bg064/_mapping

#测试解析器
POST _analyze
{
“analyzer”: “standard”,
“text”:“hello,world,hello.java; she is a good girl”

}

GET bg064/text01/_search
{
“query”: {
“bool”: {
“must”:{
“match”:{
“hello”:“world”
}
}
}
}
}

GET bg064/text01/1
{
“query”: {
“match_all”: {}
}
}

#这个是加载的插件在es的目录下 中文解析器名为 ik_max_word
POST _analyze
{
“analyzer”: “ik_max_word”,
“text”:“美国留给伊拉克的是个烂摊子吗”
}

GET bank/_search
{
“size”: 1,
“query”: {
“match_all”: {}
}
}

#Histogram Aggregation(multi-bucket)
#直方图,按照balance字段(必须是数值类型) 每间隔100分一个桶 自动分的哦~~
GET bank/_search
{
“size”: 0,
“aggs”: {
“balanceS”: {
“histogram”: {
“field”: “balance”,
“interval”: 100

  }
}

}
}

#这个是有日期的字段…
GET kibana_sample_data_ecommerce/_search

GET kibana_sample_data_flights/_search

GET kibana_sample_data_logs/_search

#Date Histogram Aggregation(multi-bucket)
#日期直方图,按照order_date字段每隔周统计分桶,自动分的哦~ 日期格式为yyyy-MM-dd’T’HH:mm:ss.SSS Z,
GET kibana_sample_data_ecommerce/_search
{
“size”: 0,
“aggs”: {
“articles_over_time”: {
“date_histogram”: {
“field”: “order_date”,
“interval”: “week”,
“format”: “yyyy-MM-dd’T’HH:mm:ss.SSS Z”,
“time_zone”: “+08:00”
}
}
}
}

#Range Aggregation(multi-bucket)
#自定义分桶数,基于年龄区间分为个桶(只能是数值类型)

GET bank/_search
{

“size”: 0,
“aggs”: {
“price_ranges”: {
“range”: {
“field”: “age”,
“ranges”: [
{
“to”:10
},
{
“from”:10,
“to”:20
},
{
“from”:20,
“to”:40
},
{
“from”:40,
“to”:100
}
]
}
}
}
}

#Date Range Aggregation(multi-bucket)
#自定义日期直方图,按照日期分桶分了3个桶…

GET kibana_sample_data_ecommerce/_search
{
“size”: 0,
“aggs”: {
“date_range”: {
“date_range”: {
“field”: “order_date”,
“ranges”: [
{
“to”:“2019-05-01”
},
{
“from”:“2019-05-01”,
“to”:“2019-05-18”
},
{
“from”:“2019-05-18”,
“to”:“2019-06-18”
}
]
}
}
}
}

#Terms Aggregation(multi-bucket)
#词元聚合 基于字段聚合 等同于 select…group by
#先根据项将性别聚合在以工资聚合 = 以性别分组算工资总和
GET bank/_search
{
“size”: 0,
“aggs”: {
“terms_aggs”: {
“terms”: {
“field”: “gender.keyword”
},
“aggs”: {
“stats_aggs”: {
“stats”: {
“field”: “balance”
}
}
}
}
}
}

#Filters Aggregation(multi-bucket)
#多过滤聚合——基于多个过滤条件，来对当前文档进行【过滤】的聚合，每个过滤都包含所有满足它的文档（多个bucket中可能重复）。

#一层过滤:先把不在条件内的都归属为other_bucket_message桶,
#二层过滤:将符合条件的 200 400 状态码归为另外俩个桶

GET kibana_sample_data_logs/_search
{
“size”: 0,
“aggs”: {
“filter_aggs”: {
“filters”: {
“other_bucket_key”:“other_bucket_message”,
“filters”:{
“200”:{
“term”:{
“response.keyword”:200
}
},
“400”:{
“term”: {
“response.keyword”: 404
}
}
}
}
}
}
}

#桶均值聚合 针对的是桶操作,而非文档操作
#先根据性别分组,然后求总和和平均值,后面用管道聚合将父指定子桶
GET bank/_search
{
“size”: 0,
“aggs”: {
“terms_aggs”: {
“terms”: {
“field”: “gender.keyword”
},
“aggs”: {
“sum_balance”: {
“sum”: {
“field”: “balance”
}
},
“avg_balance”:{
“avg”:{
“field”:“balance”

      }
    }
  }
},
"avg_bucket_genner":{
  "avg_bucket": {
    "buckets_path": "terms_aggs>avg_balance"
  }
}

}
}