Elasticsearch 认证模拟题 - 1

1、题目

定义一个数据流，满足 data-stream_*_*，数据首先分布在 data_hot，5分钟后移动到 data_warm，3分钟后到 data_cold，再过 8 分钟删除。

1.1 考点

1. 生命周期
2. 索引模板
3. 数据流

1.2 答案

# 修改生命周期策略修改时间
PUT /_cluster/settings
{
  "persistent": {
    "indices.lifecycle.poll_interval": "1m"
  },
  "transient": {
    "indices.lifecycle.poll_interval": "1m"
  }
}

# 创建策略
PUT _ilm/policy/policy_8m
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
        }
      }, 
      "warm": {
        "min_age": "1m",
        "actions": {
        }
      },
      "delete": {
        "min_age": "2m",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

# 创建模板
PUT _index_template/policy_8m_template
{
  "index_patterns": ["data-stream_*_*"],
  "template": {
    "settings": {
      "number_of_shards": 3,
      "index.lifecycle.name": "policy_8m"
    }
  },
  "data_stream": { },
  "priority": 500
}

# 创建一个数据流
PUT _data_stream/data-stream_05_27

# 向数据流写入数据
PUT data-stream_05_27/_bulk
{ "create":{ } }
{ "@timestamp": "2099-05-06T16:21:15.000Z", "message": "192.0.2.42 - - [06/May/2099:16:21:15 +0000] \"GET /images/bg.jpg HTTP/1.0\" 200 24736" }
{ "create":{ } }
{ "@timestamp": "2099-05-06T16:25:42.000Z", "message": "192.0.2.255 - - [06/May/2099:16:25:42 +0000] \"GET /favicon.ico HTTP/1.0\" 200 3638" }

注1： 数据流至少对应一个隐藏索引，数据流仅剩余一个隐藏索引的时候，索引生命周期不会删除索引
注2： 索引生命周期的每个节点都必须对应 action ，哪怕 action 是空的

2、题目

有一个索引 task2，存在 field2 字段，用 match 匹配 the 能查到很多数据，现要求对 task2 索引进行重建，达到使用 match 匹配 the 不能查询到数据的目的。

# 创建符合条件的 task2 索引，设置 field2 字段，并写入数据，简单查询
PUT task2
{
  "mappings": {
    "properties": {
      "field2":{
        "type": "text"
      }
    }
  }
}

POST task2/_bulk
{"index": {}}
{"field2":"the school"}
{"index": {}}
{"field2":"the apple"}
{"index": {}}
{"field2":"the world"}

GET task2/_search
{
  "query": {
    "match": {
      "field2": "the"
    }
  }
}

2.1 考点

1. match匹配查询
2. 分词器的使用
   • 2.1 Character filters： 字符过滤器
   • 2.2 Tokenizer： 分词器
   • 2.3 Token filter： 词过滤器
3. 索引重建

2.2 答案

# 定义索引 task3，自定义分词器 my_custom_analyzer，
PUT task3
{
  "settings": {
    "analysis": {
      "analyzer": {
        "my_custom_analyzer": { 
          "char_filter": [ ],
          "tokenizer": "standard",
          "filter": [
            "lowercase",
            "english_stop"
          ]
        }
      },
      "char_filter": {
        "emoticons": { 
          "type": "mapping",
          "mappings": [
            "the => "
          ]
        }
      },
      "filter": {
        "english_stop": { 
          "type": "stop",
          "stopwords": [ "the" ]
        }
      }
    }
  },
  "mappings": {
    "properties": {
      "field2": {
        "type": "text",
        "analyzer": "my_custom_analyzer"
      }
    }
  }
}

# 重建索引 task2 的数据 到 task3
POST _reindex
{
  "source": {
    "index": "task2"
  },
  "dest": {
    "index": "task3"
  }
}


# 查询
GET task3/_search
GET task3/_search
{
  "query": {
    "match": {
      "field2": "the"
    }
  }
}

24-06-30 更新一下答案，上面的答案虽然没有问题，但是有些啰嗦了。答案有两种，第一种是使用停用词的方式

PUT task2_new
{
  "settings": {
    "analysis": {
      "analyzer": {
        "my_stop_analyzer": {
          "type": "stop",
          "stopwords": [
            "the"
          ]
        }
      }
    }
  },
  "mappings": {
    "properties": {
      "field2": {
        "type": "text",
        "analyzer": "my_stop_analyzer"
      }
    }
  }
}

第二种是使用 char_filter 过滤 单词 the

PUT task2_new
{
  "settings": {
    "analysis": {
      "analyzer": {
        "my_custom_analyzer": {
          "type": "custom", 
          "tokenizer": "standard",
          "char_filter": [
            "the_to_none"
          ],
          "filter": [
          ]
        }
      },
      "char_filter": {
        "the_to_none": { 
          "type": "mapping",
          "mappings": [
            "the =>"
          ]
        }
      }
    }
  },
  "mappings": {
    "properties": {
      "field2": {
        "type": "text",
        "analyzer": "my_custom_analyzer"
      }
    }
  }
}