Elasticsearch 7.x笔记

修改mapping

• 查询旧index的mapping

GET /network_event/_mapping

• 建一个新的索引，并指定mapping，指定要修改的字段即可，其它字段可自动生成

PUT /network_event_v2
{
    "mappings" : {
      "properties" : {
        "content" : {
          "type" : "text",
          "analyzer": "ik_max_word"
        }
      }
    }
  }

• 将旧索引的数据迁移至新索引

POST /_reindex
{
  "source": {
    "index": "network_event"
  },
  "dest": {
    "index": "network_event_v2"
  }
}

• 查看新索引的mapping以及数据情况

GET /network_event_v2/_mapping

GET /network_event_v2/_search
{
  "query": {
    "match_all": {}
  }
}

• 删除旧索引

DELETE /network_event

• 给新索引添加别名。以后可通过别名存取数据，方便日后再次修改mapping

PUT /network_event_v2/_aliases
{
	"actions": [
		{"add": {"index": "network_event_v2", "alias": "network_event"}}
	]
  }

• 查看别名以及数据查询情况

GET /network_event/_alias

GET /network_event/_search
{
  "query": {
    "match_all": {}
  }
}

• 别名若指定错误可这样删除

DELETE /network_event_v2/_alias/network_event

mapping新增字段

PUT /network_alarm/_mapping
{
    "properties":{
       "recovery_time": {
         "type" : "date",
         "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd HH:mm||yyyy-MM-dd||epoch_millis"
       }
    }
}

导入远程数据

1. 在本地创建index，写好mapping
2. 将远程数据导入到本地

POST /_reindex
    {
      "source": {
        "index": "blogs",
        "remote": {
          "host": "http://remote_cluster_node1:9200",
          "username": "USERNAME",
          "password": "PASSWORD"
        }
      },
      "dest": {
        "index": "blogs"
      }
    }

设置查询数量的限制

PUT /network_event/_settings
{
 "max_result_window": "200000"
}

查询时使用参数"track_total_hits": True 能返回实际数据数量