Elasticsearch 认证模拟题 - 12

一、题目

在集群上有 task2 索引，请重建它到 task2_new 索引上，并满足以下要求：

1. task2 索引的 a 字段包含有关键字 Yoo-Hoo 和 YooHoo，不管搜索 Yoo-Hoo 还是YooHoo 它们的结果应该一样
2. task2_new 和 task2 的 mapping 应该一样

POST task2/_bulk
{"index":{}}
{"a":"Yoo-Hoo"}
{"index":{}}
{"a":"YooHoo"}

1.1 考点

1. 分词器

1.2 答案

# 创建索引结构，自定义分词器
PUT task2_new
{
  "settings": {
    "analysis": {
      "analyzer": {
        "my_custom_analyzer": {
          "type": "custom",
          "tokenizer": "standard",
          "char_filter": ["remove-"],
          "filter": []
        }
      },
      "char_filter": {
          "remove-": {
            "type": "mapping",
            "mappings": [
              "- => "
            ]
          }
        }
    }
  },
  "mappings": {
    "properties": {
      "a":{
        "type": "text",
        "analyzer": "my_custom_analyzer"
      }
    }
  }
}

# 写入数据
POST task2_new/_bulk
{"index":{}}
{"a":"Yoo-Hoo"}
{"index":{}}
{"a":"YooHoo"}

# 验证结果
GET task2_new/_search
{
  "query": {
    "match": {
      "a": "YooHoo"
    }
  }
}
GET task2_new/_search
{
  "query": {
    "match": {
      "a": "Yoo-Hoo"
    }
  }
}

二、题目

earthquakes 索引中包含了过去11个月的地震信息，请通过一句查询，获取以下信息

1. 过去11个月，每个月的平均地震等级(magnitude)
2. 过去11个月里，平均地震等级最高的一个月及其平均地震等级
3. 搜索不能返回任何文档

# 创建索引
PUT earthquakes
{
  "settings": {
    "number_of_replicas": 0
  },
  "mappings": {
    "properties": {
      "timestamp": {
        "type": "date",
        "format": "yyyy-MM-dd HH:mm:ss"
      },
      "magnitude": {
        "type": "float"
      }
    }
  }
}

# 导入数据
POST earthquakes/_bulk
{"index":{}}
{"timestamp":"2012-01-01 12:12:12", "magnitude":4.56}
{"index":{}}
{"timestamp":"2012-01-01 15:12:12", "magnitude":6.46}
{"index":{}}
{"timestamp":"2012-02-02 13:12:12", "magnitude":4}
{"index":{}}
{"timestamp":"2012-03-02 13:12:12", "magnitude":6}
{"index":{}}
{"timestamp":"1967-03-02 13:12:12", "magnitude":6}

2.1 考点

1. 分桶聚类
2. 指标聚类
3. 管道聚类

2.2 答案

POST earthquakes/_search
{
  "size": 0,
  "aggs": {
    "every_month": {
      "date_histogram": {
        "field": "timestamp",
        "calendar_interval": "month",
        "format": "yyyy-MM-dd"
      },
      "aggs": {
        "avg_magnitude": {
          "avg": {
            "field": "magnitude"
          }
        }
      }
    },
    "max_magnitude": {
      "max_bucket": {
        "buckets_path": "every_month>avg_magnitude" 
      }
    }
  }
}

24-06-30 更新一版答案，主要是去掉了空桶

GET earthquakes/_search
{
  "size": 0,
  "aggs": {
    "over_timestamp_date_histogram": {
      "date_histogram": {
        "field": "timestamp",
        "calendar_interval": "month",
        "min_doc_count": 1
      },
      "aggs": {
        "magnitude_avg": {
          "avg": {
            "field": "magnitude"
          }
        }
      }
    },
    "max_monthly_sales": {
      "max_bucket": {
        "buckets_path": "over_timestamp_date_histogram>magnitude_avg" 
      }
    }
  }
}