常用操作
創(chuàng)建文檔
PUT /indexName/indexType/1
{
"first_name" : "John",
"last_name" : "Smith",
"age" : 25,
"about" : "I love to go rock climbing",
"interests": [ "sports", "music" ]
}
檢索文檔
GET /_search //all
GET /megacorp/employee/1 //id
GET /megacorp/employee/_search //全部
GET /megacorp/employee/_search?q=last_name:Smith
GET /megacorp/employee/_search
{
"query" : {
"match" : {
"last_name" : "Smith"
}
}
}
//搜索姓氏為 Smith 的員工，且年齡大于 30 的
GET /megacorp/employee/_search
{
"query" : {
"bool": {
"must": {
"match" : {
"last_name" : "smith"
}
},
"filter": {
"range" : {
"age" : { "gt" : 30 }
}
}
}
}
}
//僅匹配同時(shí)包含 “rock” 和 “climbing” ，并且 二者以短語(yǔ) “rock climbing” 的形式緊挨著的記錄
GET /megacorp/employee/_search
{
"query" : {
"match_phrase" : {
"about" : "rock climbing"
}
}
}
//挖掘員工中最受歡迎的興趣愛好
GET /megacorp/employee/_search
{
"aggs": {
"all_interests": {
"terms": { "field": "interests" }
}
}
}
//檢查查詢語(yǔ)句不合法的信息,或?yàn)楹纹ヅ?為何不匹配
GET /indexName/indexType/_validate/query?explain
{
"query": {
"tweet" : {
"match" : "really powerful"
}
}
}
//查詢目前所有索引
curl -XGET 127.0.0.1:9200/_cat/indices
*
更多參考ES權(quán)威指南
更多查詢示例
刪除文檔
DELETE /website/blog/123
更新文檔
//部分更新，增加字段 tags 和 views
POST /website/blog/1/_update
{
"doc" : {
"tags" : [ "testing" ],
"views": 0
}
}
//使用腳本來(lái)增加博客文章中 views 的數(shù)量
POST /website/blog/1/_update
{
"script" : "ctx._source.views+=1"
}
并發(fā)更新控制
https://www.elastic.co/guide/cn/elasticsearch/guide/current/optimistic-concurrency-control.html
創(chuàng)建索引
PUT /blogs
{
"settings" : {
"number_of_shards" : 3, //主分片
"number_of_replicas" : 1 //副本分片
}
}
刪除索引
DELETE /indexName
DELETE /_all //刪除所有索引，可以配置不允許這樣操作
創(chuàng)建索引指定映射
PUT /indexName
{
"mappings": {
"indexType" : {
"properties" : {
"tweet" : {
"type" : "string",
"analyzer": "english"
},
"date" : {
"type" : "date"
},
"name" : {
"type" : "string"
},
"user_id" : {
"type" : "long"
}
}
}
}
}
增加mapping
PUT /indexName/_mapping/indexType
{
"properties" : {
"tag" : {
"type" : "string",
"index": "not_analyzed"
}
}
}
配置索引模版
PUT /_template/模版名稱
{
"template": "logstash-*",
"order": 1, //越大優(yōu)先級(jí)越高
"settings": {
"number_of_shards": 1 //限制主分片數(shù)量為 1
},
"mappings": {
"_default_" : {
"properties" : {
"ip" :{
"type":"ip"
}
}
}
},
"aliases": {
"last_3_months": {} //添加這個(gè)索引至 last_3_months 別名中
}
}
查詢mapping
GET /indexName/_mapping/indexType //查詢指定索引的mapping
測(cè)試mapping
GET /indexName/_analyze
{
"field": "tweet",
"text": "Black-cats"
}
默認(rèn)映射
當(dāng)你索引一個(gè)包含新域的文檔—?之前未曾出現(xiàn)-- Elasticsearch 會(huì)使用動(dòng)態(tài)映射
https://www.elastic.co/guide/cn/elasticsearch/guide/current/mapping-intro.html
生產(chǎn)建議
重要配置修改（elasticsearch.yml 文件中）
//指定集群及機(jī)器名稱
cluster.name: elasticsearch_production
node.name: elasticsearch_005_data
//數(shù)據(jù)路徑
path.data: /path/to/data1,/path/to/data2
path.logs: /path/to/logs
path.plugins: /path/to/plugins
//最小主節(jié)點(diǎn)數(shù)
discovery.zen.minimum_master_nodes: 2 //( master 候選節(jié)點(diǎn)個(gè)數(shù) / 2) + 1
//集群恢復(fù)方面的配置，防止因節(jié)點(diǎn)重啟等情況發(fā)生數(shù)據(jù)移動(dòng)
gateway.expected_nodes: 10
gateway.recover_after_time: 5m
//使用單播代替組播（默認(rèn)）？？？
discovery.zen.ping.unicast.hosts: ["host1", "host2:port"]
//禁用 swap
bootstrap.mlockall: true
線程池的線程數(shù)最多設(shè)置成核心數(shù)的2倍
堆大小默認(rèn)是1G，偏小
./bin/elasticsearch -Xmx10g -Xms10g //啟動(dòng)時(shí)調(diào)整
export ES_HEAP_SIZE=10g //設(shè)置環(huán)境變量留下一半內(nèi)存給Lucene，它占用的是堆外內(nèi)存
Elasticsearch內(nèi)存也不要超過(guò)32G設(shè)置好文件描述符的大小
可以在/etc/sysctl.conf 通過(guò)修改 vm.max_map_count 設(shè)置它
其他需要注意的配置（elasticsearch.yml 文件中）
//是否禁止自動(dòng)創(chuàng)建索引
action.auto_create_index: false
