Elasticsearch学习笔记

初识Elasticsearch：

1 启动ES

su elasticsearch

/hadoop/elasticsearch-2.4.3/bin/elasticsearch -d

(注：若无账号则创建账号

创建用户：adduser elasticsearch

赋予可执行权限：chown -R elasticsearch /hadoop/elasticsearch-2.4.3

)

--查看进程

ps aux|grep elasticsearch

2 查看节点信息

curl 'http://127.0.0.1:9200/_cat/nodes?v'

3 查看全部索引

curl 'http://127.0.0.1:9200/_cat/indices?v'

4 创建索引

curl -XPUT 'http://127.0.0.1:9200/mytest?pretty'

--删除索引

curl -XDELETE 'http://127.0.0.1:9200/mytest?pretty'

5 插入数据

curl -XPUT 'http://127.0.0.1:9200/mytest/external/1?pretty' -d '{"name": "John Doe"}'

curl -XPUT 'http://127.0.0.1:9200/mytest/external/5?pretty' -d '{"name": "Tom"}'

curl -XPOST 'http://127.0.0.1:9200/mytest/external/1/_update?pretty' -d '{"doc": { "age": 20 }}'

curl -XPOST 'http://127.0.0.1:9200/mytest/external/2/_update?pretty' -d '{"doc": { "age": 25 }}'

curl -XPOST 'http://127.0.0.1:9200/mytest/external/3/_update?pretty' -d '{"doc": { "age": 30 }}'

6 删除

curl -XDELETE 'http://127.0.0.1:9200/mytest/external/2?pretty'

curl -XDELETE 'http://127.0.0.1:9200/mytest/external/_query?pretty' -d '

    {

      "query": { "match": { "name": "John" } }

    }'

7 查询 match 是模糊查询 term 是精确查询 

curl -XGET 'http://127.0.0.1:9200/mytest/external/1?pretty'

curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"from":"0","size":"6"}'

curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"match":{"srcip":"221.176.67.103"}}}'

curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"match":{"srcport":"0"}}}'

--模糊匹配

curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"match_phrase":{"name":"名字是张三"}}}'

curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"term":{"name":"名字是李四"}}}'

curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"bool":{"must":{"term":{"name":"名字是李四"}}}}}'

--精确匹配

curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"bool":

{

"must":{"term":{"name":"名"}},

"must":{"term":{"name":"字"}},

"must":{"term":{"name":"是"}},

"must":{"term":{"name":"李"}},

"must":{"term":{"name":"四"}}

}

}}'

curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"bool":

{

"must":{"term":{"name":"名"}},

"must":{"term":{"name":"字"}},

"must":{"term":{"name":"是"}},

"must":{"term":{"name":"李"}}

}

}}'

curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"bool":{"must_not":{"term":{"age":20}},"must":{"term":{"name":"张三"}}}}}'

8 多条件查询 

curl -XGET 'http://127.0.0.1:9200/event/event/_search?pretty' -d '{"query": {"bool": {"should": [{ "match": { "sourceip":  "221.176.67.10" }},{ "match": { "destip": "221.176.67.101"   }}]}}}'

curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query": {"bool": {"should": [{ "match": { "name":  "名字是" }},{ "match": { "name": "张三"   }}]}}}'

9 按时间查询

curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"range":{"opentime":{"gte":"1495414800000"}}}}'

curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"range":{"opentime":{"gte":"1495697415000","lte":"1495697415000"}}}}'

10 聚合

curl -XGET '172.16.10.74:9200/event/event/_search?pretty'  -d'

{

   "size" : 0,

   "aggs": {

      "sales": {

         "date_histogram": {

            "field": "opentime",

            "interval": "month", 

            "format": "yyyy-MM-dd" 

         }

      }

   }

}

'