环境：es(7.14.0)+kibana(7.14.2)

一、ES查询示例

1、查看es信息

GET /

2、创建索引

PUT demo_person

3、删除索引

DELETE demo_person

说明：

DELETE /index_one,index_two  --删除两个索引

DELETE /index_*  --删除index_k开头的索引

DELETE /_all  --删除全部索引

DELETE /*  --删除全部索引

4、创建索引包含setting和mapping

PUT demo_person
{
    "settings": {
      "number_of_shards": 5,
      "number_of_replicas": 1 
    },
    "mappings": {
	  "properties": {
		"about": {
		  "type": "text",
		  "fields": {
			"keyword": {
			  "type": "keyword",
			  "ignore_above": 256
			}
		  }
		},
		"age": {
		  "type": "long"
		},
		"first_name": {
		  "type": "text",
		  "fields": {
			"keyword": {
			  "type": "keyword",
			  "ignore_above": 256
			}
		  }
		},
		"interests": {
		  "type": "text",
		  "fields": {
			"keyword": {
			  "type": "keyword",
			  "ignore_above": 256
			}
		  },
		  "fielddata": true
		},
		"last_name": {
		  "type": "keyword"
		}
	 }
  }
}

5、修改setting

PUT demo_person/_settings
{
  "number_of_replicas" : 2
}

只能修改副本分片，主分片在创建索引时确定，后续不可以再次修改

6、修改mapping

PUT demo_person/_mapping/_doc?include_type_name=true
{
    "properties":{
        "interests":{
            "type":"text",
            "fielddata":true
        }
    }
}

7、查询总数

GET demo_person/_count
{ 
  "query": {
    "match_all": {}
  }
}

8、添加/修改数据

PUT /demo_person/_doc/1
{
    "first_name" : "John",
    "last_name" :  "Smith",
    "age" :        25,
    "about" :      "I love to go rock climbing",
    "interests": [ "sports", "music" ]
}

9、批量插入数据

POST demo_person/_bulk
{"index":{}}
{"first_name":"zhang","last_name":"san","age" :44,"about":"I like to collect hehe albums","interests":["music"]}
{"index":{}}
{"first_name":"li","last_name":"si","age":12,"about":"I like to drink","interests":["drink"]}

10、查询所有数据

GET demo_person/_search
{  
  "query": {
    "match_all": {}
  }
}

11、查询指定条数

GET demo_person/_search
{  "size": 20, 
  "query": {
    "match_all": {}
  }
}

12、根据ID查询

GET /demo_person/_doc/1?pretty

13、一个查询字符串搜索

GET /demo_person/_search?q=last_name:Smith

14、match搜索

GET /demo_person/_search
{
    "query" : {
        "match" : {
            "last_name" : "Smith"
        }
    }
}

15、term搜索

GET /demo_person/_search
{
  "query": {
    "term": {
      "last_name": {
        "value": "Smith"
      }
    }
  }
}

基于词项的查询

如 term 或 fuzzy 这样的底层查询不需要分析阶段，它们对单个词项进行操作。用 term 查询词项 Foo 只要在倒排索引中查找 准确词项 ，并且用 TF/IDF 算法为每个包含该词项的文档计算相关度评分 _score 。

记住 term 查询只对倒排索引的词项精确匹配，这点很重要，它不会对词的多样性进行处理（如， foo 或 FOO ）。这里，无须考虑词项是如何存入索引的。如果是将 ["Foo","Bar"] 索引存入一个不分析的（ not_analyzed ）包含精确值的字段，或者将 Foo Bar 索引到一个带有 whitespace 空格分析器的字段，两者的结果都会是在倒排索引中有 Foo 和 Bar 这两个词。

基于全文的查询

像 match 或 query_string 这样的查询是高层查询，它们了解字段映射的信息：

如果查询 日期（date） 或 整数（integer） 字段，它们会将查询字符串分别作为日期或整数对待。

如果查询一个（ not_analyzed ）未分析的精确值字符串字段，它们会将整个查询字符串作为单个词项对待。

但如果要查询一个（ analyzed ）已分析的全文字段，它们会先将查询字符串传递到一个合适的分析器，然后生成一个供查询的词项列表。

16、bool搜索

GET /demo_person/_search
{
  "query": {
    "bool": {
      "must": [
        {"match": {
          "last_name": "Smith"
        }}
      ],
      "filter": [
        {"range": {
          "age": {
            "gte": 30
          }
        }}
      ]
    }
  }
}

说明：

must:   完全匹配条件      相当于sql中的and

should： 至少满足一个条件     相当于sql中的 or

must_not: 文档必须不匹配条件     相当于sql中的!=

17、must多条件匹配查询

GET /demo_person/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
          "last_name": "Smith"
          }
        },
        {
          "match": {
            "age": 32
          }
        }
      ]
    }
  }
}

18、Should满足一个条件查询

GET /demo_person/_search
{
  "query": {
    "bool": {
      "should": [
        {
          "match": {
          "last_name": "Fir"
          }
        },
        {
          "match": {
            "age": 32
          }
        }
      ]
    }
  }
}

19、must_not必须不匹配查询

GET /demo_person/_search
{
  "query": {
    "bool": {
      "must_not": [
        {
          "match": {
          "last_name": "Fir"
          }
        },
        {
          "match": {
            "age": 32
          }
        }
      ]
    }
  }
}

20、多个字段查询内容

GET /demo_person/_search
{
 "query": {
    "multi_match": {
      "query": "collect rock",
      "fields": ["last_name","about"]
    }
 }
}

21、一个字段查询多个内容

GET /demo_person/_search
{
 "query": {
   "terms": {
     "about": [
       "rock",
       "hehe"	
     ]
   }
 }	
}

22、通配符和正则匹配

GET /demo_person/_search
{
 "query": {
   "bool": {
     "filter": [
      {
         "wildcard":{
         "last_name":"*mi*"
        }
      }]
   }
 }
}

23、前缀查询

GET /demo_person/_search
{
 "query": {
   "prefix": {
     "last_name": {
       "value": "Smi"
     }
   }
 }
}

24、短语匹配

GET /demo_person/_search
{
    "query" : {
        "match_phrase" : {
            "about" : "rock climbing"
        }
    }
}

25、输入即搜索

GET /demo_person/_search
{
 "query": {
   "match_phrase_prefix": {
     "about": "I like to collect"
   }
 }
}

26、高亮搜索

GET /demo_person/_search
{
    "query" : {
        "match_phrase" : {
            "about" : "rock climbing"
        }
    },
    "highlight": {
        "fields" : {
            "about" : {}
        }
    }
}

27、统计

GET /demo_person/_search
{
  "aggs": {
    "all_result": {
      "terms": { "field": "interests" }
    }
  }
}

28、根据条件统计

GET /demo_person/_search
{
  "query": {
    "match": {
      "last_name": "smith"
    }
  },
  "aggs": {
    "all_interests": {
      "terms": {
        "field": "interests"
      }
    }
  }
}

29、获取平均数

GET /demo_person/_search
{
    "aggs" : {
        "all_interests" : {
            "terms" : { "field" : "interests" },
            "aggs" : {
                "avg_age" : {
                    "avg" : { "field" : "age" }
                }
            }
        }
    }
}

30、多个字段匹配查询

GET /demo_person/_search
{
  "query": {
    "multi_match": {
      "query": "Smith",
      "fields": ["last_name","about"]
    }
  }
}

31、范围查询

GET demo_person/_search
{  
  "query": {
    "range": {
      "age": {
        "gte": 30,
        "lt": 35
      }
    }
  }
}

32、排序

GET /demo_person/_search
{
  "query": {
    "bool": {
      "must": [
        {"term": {	
          "last_name.keyword": {
            "value": "Smith"
          }
        }},
        {
          "term": {
            "about": {
              "value": "climbing"
            }
          }
        }
      ]
    }
  },
  "sort": [
    {
      "last_name": {
        "order": "desc"
      }
    }
  ]
}

33、删除一条数据

DELETE /demo_person/_doc/TC4cJ4ABPbcGgBnacj_w

34、批量删除

POST /_bulk
{"delete":{"_index":"demo_person","_id":"1"}}
{"delete":{"_index":"demo_person","_id":"12"}}

35、分页查询

GET /demo_person/_search?from=1&size=10
或者
GET /demo_person/_search
{
  "from": 1,
  "size": 10
}

Size：显示应该返回的结果数量，默认是 10

From：显示应该跳过的初始结果数量，默认是 0

36、游标查询

GET /demo_person/_search?scroll=5m
{
  "query": {
    "match_all": {}
  },
  "sort": [
    {
      "_doc": {
        "order": "desc"
      }
    }
  ],
  "size": 1
}

然后获取scroll_id继续查询，如下

GET _search/scroll
{
  "scroll":"5m",  
"scroll_id":"FGluY2x1ZGVfY29udGV4dF91dWlkDnF1ZXJ5VGhlbkZldGNoBRZybzdMSjJ2NVNiV0poWVhwbFEtYmdnAAAAAAEj8FgWV0QzQ0pVQm9URnVBVFpmOGpDSC05QRZybzdMSjJ2NVNiV0poWVhwbFEtYmdnAAAAAAEj8FkWV0QzQ0pVQm9URnVBVFpmOGpDSC05QRZybzdMSjJ2NVNiV0poWVhwbFEtYmdnAAAAAAEj8FoWV0QzQ0pVQm9URnVBVFpmOGpDSC05QRZybzdMSjJ2NVNiV0poWVhwbFEtYmdnAAAAAAEj8FsWV0QzQ0pVQm9URnVBVFpmOGpDSC05QRZybzdMSjJ2NVNiV0poWVhwbFEtYmdnAAAAAAEj8FwWV0QzQ0pVQm9URnVBVFpmOGpDSC05QQ=="
}

37、字段存在查询

GET /demo_person/_search
{
 "query": {
   "exists": {"field": "aa"}
 }
}

38、复杂查询demo

Demo1

{
    "bool": {
        "must":     { "match": { "tweet": "elasticsearch" }},
        "must_not": { "match": { "name":  "mary" }},
        "should":   { "match": { "tweet": "full text" }},
        "filter":   { "range": { "age" : { "gt" : 30 }} }
    }
}

demo2

{
    "bool": { 
        "must": { "match":   { "email": "business opportunity" }},
        "should": [
            { "match":       { "starred": true }},
            { "bool": {
                "must":      { "match": { "folder": "inbox" }},
                "must_not":  { "match": { "spam": true }}
            }}
        ],
        "minimum_should_match": 1
    }
}

                                                            

Demo3

GET /my_store/products/_search
{
   "query" : {
      "filtered" : {
         "filter" : {
            "bool" : {
              "should" : [
                { "term" : {"productID" : "KDKE-B-9947-#kL5"}}, 
                { "bool" : { 
                  "must" : [
                    { "term" : {"productID" : "JODL-X-1937-#pV7"}}, 
                    { "term" : {"price" : 30}} 
                  ]
                }}
              ]
           }
         }
      }
   }
}

39、拷贝索引

POST _reindex
{
  "source": {
    "index": "twitter"
  },
  "dest": {
    "index": "new_twitter"
  }
}

40、索引别名

PUT /my_index_v1 –创建索引

PUT /my_index_v1/_alias/my_index  --创建my_index_v1别名为my_index

GET /*/_alias/my_index –-查看别名指向哪个索引

GET /my_index_v1/_alias/*  --查看哪些别名指向此索引

41、查询集群健康

GET /_cluster/health

status 字段指示着当前集群在总体上是否工作正常。它的三种颜色含义如下：

green：所有的主分片和副本分片都正常运行。

Yellow：所有的主分片都正常运行，但不是所有的副本分片都正常运行。

Red:有主分片没能正常运行。