1、题目
定义一个数据流,满足 data-stream_*_*
,数据首先分布在 data_hot,5分钟后移动到 data_warm,3分钟后到 data_cold,再过 8 分钟删除。
1.1 考点
1.2 答案
# 修改生命周期策略修改时间
PUT /_cluster/settings
{
"persistent": {
"indices.lifecycle.poll_interval": "1m"
},
"transient": {
"indices.lifecycle.poll_interval": "1m"
}
}
# 创建策略
PUT _ilm/policy/policy_8m
{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
}
},
"warm": {
"min_age": "1m",
"actions": {
}
},
"delete": {
"min_age": "2m",
"actions": {
"delete": {}
}
}
}
}
}
# 创建模板
PUT _index_template/policy_8m_template
{
"index_patterns": ["data-stream_*_*"],
"template": {
"settings": {
"number_of_shards": 3,
"index.lifecycle.name": "policy_8m"
}
},
"data_stream": { },
"priority": 500
}
# 创建一个数据流
PUT _data_stream/data-stream_05_27
# 向数据流写入数据
PUT data-stream_05_27/_bulk
{ "create":{ } }
{ "@timestamp": "2099-05-06T16:21:15.000Z", "message": "192.0.2.42 - - [06/May/2099:16:21:15 +0000] \"GET /images/bg.jpg HTTP/1.0\" 200 24736" }
{ "create":{ } }
{ "@timestamp": "2099-05-06T16:25:42.000Z", "message": "192.0.2.255 - - [06/May/2099:16:25:42 +0000] \"GET /favicon.ico HTTP/1.0\" 200 3638" }
注1: 数据流至少对应一个隐藏索引,数据流仅剩余一个隐藏索引的时候,索引生命周期不会删除索引
注2: 索引生命周期的每个节点都必须对应 action
,哪怕 action
是空的
2、题目
有一个索引 task2
,存在 field2
字段,用 match 匹配 the 能查到很多数据,现要求对 task2
索引进行重建,达到使用 match 匹配 the 不能查询到数据的目的。
# 创建符合条件的 task2 索引,设置 field2 字段,并写入数据,简单查询
PUT task2
{
"mappings": {
"properties": {
"field2":{
"type": "text"
}
}
}
}
POST task2/_bulk
{"index": {}}
{"field2":"the school"}
{"index": {}}
{"field2":"the apple"}
{"index": {}}
{"field2":"the world"}
GET task2/_search
{
"query": {
"match": {
"field2": "the"
}
}
}
2.1 考点
2.2 答案
# 定义索引 task3,自定义分词器 my_custom_analyzer,
PUT task3
{
"settings": {
"analysis": {
"analyzer": {
"my_custom_analyzer": {
"char_filter": [ ],
"tokenizer": "standard",
"filter": [
"lowercase",
"english_stop"
]
}
},
"char_filter": {
"emoticons": {
"type": "mapping",
"mappings": [
"the => "
]
}
},
"filter": {
"english_stop": {
"type": "stop",
"stopwords": [ "the" ]
}
}
}
},
"mappings": {
"properties": {
"field2": {
"type": "text",
"analyzer": "my_custom_analyzer"
}
}
}
}
# 重建索引 task2 的数据 到 task3
POST _reindex
{
"source": {
"index": "task2"
},
"dest": {
"index": "task3"
}
}
# 查询
GET task3/_search
GET task3/_search
{
"query": {
"match": {
"field2": "the"
}
}
}
24-06-30 更新一下答案,上面的答案虽然没有问题,但是有些啰嗦了。答案有两种,第一种是使用停用词的方式
PUT task2_new
{
"settings": {
"analysis": {
"analyzer": {
"my_stop_analyzer": {
"type": "stop",
"stopwords": [
"the"
]
}
}
}
},
"mappings": {
"properties": {
"field2": {
"type": "text",
"analyzer": "my_stop_analyzer"
}
}
}
}
第二种是使用 char_filter
过滤 单词 the
PUT task2_new
{
"settings": {
"analysis": {
"analyzer": {
"my_custom_analyzer": {
"type": "custom",
"tokenizer": "standard",
"char_filter": [
"the_to_none"
],
"filter": [
]
}
},
"char_filter": {
"the_to_none": {
"type": "mapping",
"mappings": [
"the =>"
]
}
}
}
},
"mappings": {
"properties": {
"field2": {
"type": "text",
"analyzer": "my_custom_analyzer"
}
}
}
}