作者：劉賓， thomas_liub@hotmail.com
轉(zhuǎn)載請(qǐng)注明出處，謝謝！
參考：
http://www.ruanyifeng.com/blog/2017/08/elasticsearch.html
https://es.xiaoleilu.com/index.html
1. 安裝與配置，最新版本6.2.2
1.1 dockercompose.yml
elasticsearch:
build: elasticsearch/
#cpuset: 3,4,5
volumes:
- ./elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
- /srv/docker/elk/elastic/data:/usr/share/elasticsearch/data
ports:
- "9200:9200"
- "9300:9300"
environment:
ES_JAVA_OPTS: "-Xmx256m -Xms256m"
kibana:
build: kibana/
#cpuset: 3,4,5
volumes:
- ./kibana/config/:/opt/kibana/config/
ports:
- "5601:5601"
links:
- elasticsearch
~
1.2 配置文件， ./elasticsearch/config/elasticsearch.yml
## Default Elasticsearch configuration from elasticsearch-docker.
## from https://github.com/elastic/elasticsearch-docker/blob/master/build/elasticsearch/elasticsearch.yml
#
cluster.name: "docker-cluster"
network.host: 0.0.0.0
# minimum_master_nodes need to be explicitly set when bound on a public IP
# set to 1 to allow single node clusters
# Details: https://github.com/elastic/elasticsearch/pull/17288
discovery.zen.minimum_master_nodes: 1
## Use single node discovery in order to disable production mode and avoid bootstrap checks
## see https://www.elastic.co/guide/en/elasticsearch/reference/current/bootstrap-checks.html
#
discovery.type: single-node
## Disable X-Pack
## see https://www.elastic.co/guide/en/x-pack/current/xpack-settings.html
## https://www.elastic.co/guide/en/x-pack/current/installing-xpack.html#xpack-enabling
#
xpack.security.enabled: false
xpack.monitoring.enabled: false
xpack.ml.enabled: false
xpack.graph.enabled: false
xpack.watcher.enabled: false
1.3 設(shè)置
- 永久修改vm.max_map_count
追加vm.max_map_count=262144到/etc/sysctl.conf最后一行
sysctl -p
- 臨時(shí)修改vm.max_map_count
sysctl -w vm.max_map_count=262144
- 設(shè)置數(shù)據(jù)卷必須可寫
sudo chmod -R 777 /srv/docker/elk/elastic/data
1.4 驗(yàn)證
- 查詢當(dāng)前elasticsearch系統(tǒng)信息
GET http://192.168.32.28:9200
2. REST接口
2.1 clustur
2.2 node
2.3 shards
2.1 index
- 查詢所有index
- 增加index
- 刪除index
2.2 type
在6.0后限制使用type, 7.0后正式移除type
- 查詢index(weather)中所有types
GET http://localhost:9200/_mapping?pretty
GET http://localhost:9200/weather/_mapping?pretty
2.3 文檔
index和type可以自動(dòng)創(chuàng)建
- 增加文檔
PUT /customer/_doc/1?pretty
{
"name": "John Doe"
}
POST /customer/_doc?pretty
{
"name": "Jane Doe"
}
- 查詢文檔
GET /customer/_doc/1?pretty
{
"_index" : "customer",
"_type" : "_doc",
"_id" : "1",
"_version" : 1,
"found" : true,
"_source" : { "name": "John Doe" }
}
- 修改數(shù)據(jù)
PUT /customer/_doc/1?pretty
{
"name": "John Doe"
}
- 修改文檔
es刪除舊的文檔，添加新的文檔。
POST /customer/_doc/1/_update?pretty
{
"doc": { "name": "Jane Doe", "age": 20 }
}
- 刪除文檔
DELETE /customer/_doc/2?pretty
2.6 中文分詞
- 安裝對(duì)應(yīng)的分詞插件， 上面代碼安裝的是5.5.1版的插件，與 Elastic 5.5.1 配合使用
./bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v5.5.1/elasticsearch-analysis-ik-5.5.1.zip
- 重新啟動(dòng) Elastic
- 創(chuàng)建type
$ curl -X PUT 'localhost:9200/accounts' -d '
{
"mappings": {
"person": {
"properties": {
"user": {
"type": "text",
"analyzer": "ik_max_word",
"search_analyzer": "ik_max_word"
},
"title": {
"type": "text",
"analyzer": "ik_max_word",
"search_analyzer": "ik_max_word"
},
"desc": {
"type": "text",
"analyzer": "ik_max_word",
"search_analyzer": "ik_max_word"
}
}
}
}
}'
4. 數(shù)據(jù)查詢
4.1 查詢index/type下所有數(shù)據(jù)
localhost:9200/accounts/_search
localhost:9200/accounts/person/_search？pretty
4.2. 查詢參數(shù)方式查詢
http://192.168.32.21:9200/tests/user/_search?q=user:liu&size=2&from=1&sort=account_number:asc
http://192.168.32.21:9200/tests/user/_search?q=user:liu&size=2&from=1&sort=account_number:desc
4.3. DSL查詢
- 或條件查詢
$ curl 'localhost:9200/accounts/person/_search' -d '
{
"query" : { "match" : { "desc" : "軟件 系統(tǒng)" }}
}'
- 與條件查詢
$ curl 'localhost:9200/accounts/person/_search' -d '
{
"query": {
"bool": {
"must": [
{ "match": { "desc": "軟件" } },
{ "match": { "desc": "系統(tǒng)" } }
]
}
}
}'
- rock climbing組合查詢：
GET /megacorp/employee/_search
{
"query" : {
"match_phrase" : {
"about" : "rock climbing"
}
}
}
- 完全匹配：
GET /megacorp/employee/_search
{
"query": { "match_all": {} },
"from": 10,
"size": 10
}
GET /bank/_search
{
"query": { "match_all": {} },
"sort": { "balance": { "order": "desc" } }
}
- 指定返回信息
GET /bank/_search
{
"query": { "match_all": {} },
"_source": ["account_number", "balance"]
}
- bool query
與條件
GET /bank/_search
{
"query": {
"bool": {
"must": [
{ "match": { "address": "mill" } },
{ "match": { "address": "lane" } }
]
}
}
}
或條件
GET /bank/_search
{
"query": {
"bool": {
"should": [
{ "match": { "address": "mill" } },
{ "match": { "address": "lane" } }
]
}
}
}
GET /bank/_search
{
"query": {
"bool": {
"must_not": [
{ "match": { "address": "mill" } },
{ "match": { "address": "lane" } }
]
}
}
}
GET /bank/_search
{
"query": {
"bool": {
"must": [
{ "match": { "age": "40" } }
],
"must_not": [
{ "match": { "state": "ID" } }
]
}
}
}
- filter
return all accounts with balances between 20000 and 30000,
GET /bank/_search
{
"query": {
"bool": {
"must": { "match_all": {} },
"filter": {
"range": {
"balance": {
"gte": 20000,
"lte": 30000
}
}
}
}
}
}
- 集合運(yùn)算
GET /bank/_search
{
"size": 0,
"aggs": {
"group_by_state": {
"terms": {
"field": "state.keyword"
},
"aggs": {
"average_balance": {
"avg": {
"field": "balance"
}
}
}
}
}
}
4.4 高亮輸出：
GET /megacorp/employee/_search
{
"query" : {
"match_phrase" : {
"about" : "rock climbing"
}
},
"highlight": {
"fields" : {
"about" : {}
}
}
}
{
...
"hits": {
"total": 1,
"max_score": 0.23013961,
"hits": [
{
...
"_score": 0.23013961,
"_source": {
"first_name": "John",
"last_name": "Smith",
"age": 25,
"about": "I love to go rock climbing",
"interests": [ "sports", "music" ]
},
"highlight": {
"about": [
"I love to go <em>rock</em> <em>climbing</em>"
]
}
}
]
}
}
