elasticsearch常用命令总结(二)

冷不防 2022-11-04 11:23 238阅读 0赞

# elasticsearch常用命令总结(二) #

### 目录 ###

*  elasticsearch常用命令总结(二)
 *   *  1. 导入测试数据
     *  2. DSL 查询
     *   *  2.1 查询格式
         *  2.2 分页查询
         *  2.3 只查询指定字段
         *  2.4 指定条件查询 match
         *  2.5 搜索词组 match\_phrase
         *  2.6 多字段匹配
         *  2.7 复杂查询bool
         *  2.8 过滤 filters
         *  2.9 精确查询keyword
         *  2.10 条件查询 term
     *  3. 分析
     *   *  3.1 分组group\_by
         *  3.2 父子组合聚合
         *  3.3 组合聚合
     *  4. 映射 mapping
     *   *  4.1 创建索引，并指定
         *  4.2 查询所有映射
         *  4.3 对现有的索引添加一个字段
         *  4.4 更新映射

## 1. 导入测试数据 ##

https://download.csdn.net/download/jinian2016/15514304

POST bank/_bulk
    { "index":{ "_id":"1"}}
    { "account_number":1,"balance":39225,"firstname":"Amber","lastname":"Duke","age":32,"gender":"M","address":"880 Holmes Lane","employer":"Pyrami","email":"amberduke@pyrami.com","city":"Brogan","state":"IL"}
    { "index":{ "_id":"6"}}
    ...

## 2. DSL 查询 ##

### 2.1 查询格式 ###

GET /bank/_search
    { 
      "query": {  "match_all": { } },
      "sort": [
        {  "account_number": "asc" }
      ]
    }

返回结果

{ 
      "took" : 63,
      "timed_out" : false,
      "_shards" : { 
        "total" : 5,
        "successful" : 5,
        "skipped" : 0,
        "failed" : 0
      },
      "hits" : { 
        "total" : { 
            "value": 1000,
            "relation": "eq"
        },
        "max_score" : null,
        "hits" : [ { 
          "_index" : "bank",
          "_type" : "_doc",
          "_id" : "0",
          "sort": [0],
          "_score" : null,
          "_source" : { "account_number":0,"balance":16623,"firstname":"Bradshaw","lastname":"Mckenzie","age":29,"gender":"F","address":"244 Columbus Place","employer":"Euron","email":"bradshawmckenzie@euron.com","city":"Hobucken","state":"CO"}
        }, { 
          "_index" : "bank",
          "_type" : "_doc",
          "_id" : "1",
          "sort": [1],
          "_score" : null,
          "_source" : { "account_number":1,"balance":39225,"firstname":"Amber","lastname":"Duke","age":32,"gender":"M","address":"880 Holmes Lane","employer":"Pyrami","email":"amberduke@pyrami.com","city":"Brogan","state":"IL"}
        }, ...
        ]
      }
    }

> 字段解释

*  took –搜索所需要的时间，单位毫秒
 *  timed\_out –是否超时
 *  \_shards – 分片信息
 *  max\_score – 最高得分
 *  hits.total.value - 命中的个数
 *  hits.sort - 文档的排序位置（不按相关性得分排序时）
 *  hits.\_score -文档的相关性得分（使用时不适用match\_all）

### 2.2 分页查询 ###

将查询出第10 – 19 条记录

GET /bank/_search
    { 
      "query": {  "match_all": { } },
      "sort": [
        {  "account_number": "asc" }
      ],
      "from": 10,
      "size": 10
    }

### 2.3 只查询指定字段 ###

> \_source只返回account\_number 和 balance 两个字段

GET /bank/_search
    { 
      "query": {  "match_all": { } },
      "sort": [
        {  "account_number": "asc" }
      ],
      "from": 10,
      "size": 10,
      "_source": ["account_number","balance"]
    }

### 2.4 指定条件查询 match ###

> 全文检索， 可进行模糊查询 ，包含mill 或 包含lan 的将被检索出来  
> 最终会按评分倒排排序  
> 对检索条件进行分之匹配

GET /bank/_search
    { 
      "query": {  "match": {  "address": "mill lane" } }
    }

### 2.5 搜索词组 match\_phrase ###

> match 会将多个分词，但我们有时候，就想查询短语查询，不想分词  
> 那么这个将会适合

GET /bank/_search
    { 
      "query": {  "match_phrase": {  "address": "mill lane" } }
    }

### 2.6 多字段匹配 ###

> 表示，state 或者 address 只要包含AK 就满足条件

GET /bank/_search
    { 
      "query": { 
        "multi_match": { 
          "query": "AK",
          "fields": ["state","address"]
        }
      }
    }

### 2.7 复杂查询bool ###

> must: 必须满足  
> must\_not：必须不满足  
> should： 最好满足

GET /bank/_search
    { 
      "query": { 
        "bool": { 
          "must": [
            { 
              "match": { 
                "age": "40"
              }
            }
          ],
          "must_not": [
            { 
              "match": { 
                "state": "UT"
              }
            },
            { 
              "match": { 
                "lastname": "Walton"
              }
            }
          ],
          "should": [
            { 
              "match": { 
                "gender": "F"
              }
            }
          ]
        }
      }
    }

### 2.8 过滤 filters ###

> 可以过滤，但是不会影响相关性得分  
> bool 也可以组合filter

GET /bank/_search
    { 
      "query": { 
        "bool": { 
          "must": {  "match_all": { } },
          "filter": { 
            "range": { 
              "balance": { 
                "gte": 20000,
                "lte": 30000
              }
            }
          }
        }
      }
    }

### 2.9 精确查询keyword ###

> 以下查询可以认为address 字段的全部匹配 198 Mill Lane  
> 与match\_phrase 不一样的地方是：keyword是精确的文本匹配，  
> match\_phrase 只是不会分词，但是仍可模糊查询

GET /bank/_search
    { 
      "query": { 
        "match": { 
          "address.keyword": "198 Mill Lane"
        }
      }
    }

### 2.10 条件查询 term ###

> 和match 一样，匹配某个属性的值，  
> 全文检索时用match，其他非text字段匹配用term

GET /bank/_search
    { 
      "query": { 
        "term": { 
          "age": "20"
        }
      }
    }

## 3. 分析 ##

### 3.1 分组group\_by ###

> 搜索 address中包含mill 的所有人，  
> 然后聚合年龄分布多少人  
> 然后再看平均年龄  
> 然后再看平均薪资  
> size=0 表示只看聚合结果，不看命中列表

GET /bank/_search
    { 
      "size": 0,  
      "query": { 
        "match": { 
          "address": "mill"
        }
      },
      "aggs": { 
        "group_by_age": { 
          "terms": { 
            "field": "age",
            "size": 10
          }
        },
        "avg_age": { 
          "avg": { 
            "field": "age"
          }
        },
        "avg_balance": { 
          "avg": { 
            "field": "balance"
          }
        }
      }
    }

输出结果如下：

{ 
      "took" : 1,
      "timed_out" : false,
      "_shards" : { 
        "total" : 1,
        "successful" : 1,
        "skipped" : 0,
        "failed" : 0
      },
      "hits" : { 
        "total" : { 
          "value" : 4,
          "relation" : "eq"
        },
        "max_score" : null,
        "hits" : [ ]
      },
      "aggregations" : { 
        "avg_age" : { 
          "value" : 34.0
        },
        "group_by_age" : { 
          "doc_count_error_upper_bound" : 0,
          "sum_other_doc_count" : 0,
          "buckets" : [
            { 
              "key" : 38,
              "doc_count" : 2
            },
            { 
              "key" : 28,
              "doc_count" : 1
            },
            { 
              "key" : 32,
              "doc_count" : 1
            }
          ]
        },
        "avg_balance" : { 
          "value" : 25208.0
        }
      }
    }

### 3.2 父子组合聚合 ###

> 您可以组合聚合以构建更复杂的数据汇总。例如，以下请求将一个avg聚合嵌套在先前的 group\_by\_state聚合中，以计算每个状态的平均帐户余额。  
> 先根据state.keyword 进行分组，在这个组内，将banlance字段进行求平均数

GET /bank/_search
    { 
      "size": 0,
      "aggs": { 
        "group_by_state": { 
          "terms": { 
            "field": "state.keyword"
          },
          "aggs": { 
            "average_balance": { 
              "avg": { 
                "field": "balance"
              }
            }
          }
        }
      }
    }

### 3.3 组合聚合 ###

> 您可以通过指定terms聚合内的顺序来使用嵌套聚合的结果进行排序，

GET /bank/_search
    { 
      "size": 0,
      "aggs": { 
        "group_by_state": { 
          "terms": { 
            "field": "age"
          },
          "aggs": { 
            "gender_agg": { 
              "terms": { 
                "field": "gender.keyword"
              }
            },
            "balance_avg":{ 
              "avg": { 
                "field": "balance"
              }
            }
          }
        }
      }
    }

## 4. 映射 mapping ##

### 4.1 创建索引，并指定 ###

PUT /my-index
    { 
      "mappings": { 
        "properties": { 
          "age":{ 
            "type": "integer"
          },
          "email":{ 
            "type": "keyword"
          },
          "name":{ 
            "type": "text"
          }
        }
      }
    }

### 4.2 查询所有映射 ###

GET /my-index/_mapping

输出结果

{ 
      "my-index" : { 
        "mappings" : { 
          "properties" : { 
            "age" : { 
              "type" : "integer"
            },
            "email" : { 
              "type" : "keyword"
            },
            "name" : { 
              "type" : "text"
            }
          }
        }
      }
    }

### 4.3 对现有的索引添加一个字段 ###

PUT /my-index/_mapping
    { 
      "properties": { 
          "employee":{ 
            "type": "integer",
            "index":false
          }
        }
    }

### 4.4 更新映射 ###

> 对现有索引时不能被修改的  
> 想要修改映射只能做数据迁移  
> 即：只能新建一个新的索引，把数据迁移过去

1.  新建索引

PUT /new—index
    { 
     "mappings": { 
       "properties": { 
         "age":{ 
           "type": "integer"
         },
         "email":{ 
           "type": "keyword"
         },
         "name":{ 
           "type": "text"
         },
         "employee":{ 
           "type": "integer",
           "index":false
         }
       }
     }
    }

1.  迁移数据

POST _reindex
    { 
     "source": { 
       "index": "my-index"
     },
     "dest": { 
       "index": "new—index"
     }
    }