ES索引元字段_7_4_1

_id字段

表示doc的唯一標識,且該字段要求長度在512字節以內;
_id字段對應的值可以通過條件查詢(term,terms,match,query_string,simple_query_string)進行檢索;

//定義mapping
PUT identity_id_index
{
  "mappings": {
    "properties": {
      "text":{
        "type": "text"
      }
    }
  }
}

PUT identity_id_index/_doc/1
{
  "text":"doc with id 1"
}

PUT identity_id_index/_doc/2
{
  "text":"doc with id 2"
}
//可根據_id字段使用terms查詢
GET identity_id_index/_search
{
  "query": {
    "terms":{
      "_id":["1","2"]
    }
  }
}

_id字段值可以進行排序和聚合操作,但是如此做會加載大量數據到內存中,一般不建議這樣做;若存在排序和聚合操作的場景,可以在doc中額外定義一個字段(doc_values爲true),該字段值與_id字段值相同;

//額外定義一個字段id,其值與id字段值相同
PUT identity_id_dup_index
{
  "mappings": {
    "properties": {
      "text":{
        "type": "text"
      },
      "id":{
        "type": "keyword"
      }
    }
  }
}

PUT identity_id_index/_doc/1
{
  "text":"doc with id 1",
  "id":1
}

PUT identity_id_index/_doc/2
{
  "text":"doc with id 2",
  "id":2
}

//此處可使用id進行聚合和排序操作,不使用_id字段
GET identity_id_index/_search
{
  "aggs": {
    "id_aggs": {
      "terms": {
        "field": "id",
        "size": 10
      }
    }
  },
  "sort": [
    {
      "id": {
        "order": "desc"
      }
    }
  ]
}

//使用_id字段進行聚合和排序查詢提示過期,並建議改用另外一個字段處理 
//Deprecation: Loading the fielddata on the _id field is deprecated and will be removed in future versions. If you require sorting or aggregating on this field you should also include the id in the body of your documents, and map this field as a keyword field that has [doc_values] enabled
GET identity_id_index/_search
{
  "aggs": {
    "id_aggs": {
      "terms": {
        "field": "_id",
        "size": 10
      }
    }
  },
  "sort": [
    {
      "_id": {
        "order": "desc"
      }
    }
  ]
}

_routing字段

文檔被分配到具體分片上採用以下公式:

shard_num = hash(_routing) % num_primary_shards

默認情況下_routing值與_id值相同,若在索引時指定了routing值,則在get/delete/update操作時都需要帶上routing值,否則可能會無法找到值

//查詢自定義routing值
GET /index_type_1/_search?routing=type1,type2
{
  "query":{
    "match": {
      "title": "document"
    }
  }
}

以上查詢只在type1與type2哈希值的分片上執行,如此可以避免在所有分片索引上查找;
強制routing值必須指定,唯一id需要額外指定

PUT index_type_3
{
  "mappings": {
    "_routing": {
      "required": true
    }
  }
}

PUT index_type_3/_doc/1?routing=doc
{
  "text":"doc in type 3"
}

_source字段

_source字段記錄原始json格式的文檔,_source字段本身未建立索引(故而是不可對該字段進行查詢),但_source字段對應值會被存儲以便在執行獲取請求(get或search)時可以將其返回;

_source字段雖然非常方便,但_source字段也會增加索引的存儲開銷,若需禁止可設置enabled參數:

//索引映射時指定參數enabled爲false
PUT doc_source_index
{
  "mappings": {
    "_source": {
      "enabled": false
    }
  }
}

參數enabled置爲false,則ES將不再支持以下特性:

序號	特性
1	update、update_by_query以及reindex等api
2	高亮顯示處理相關api
3	從一個es索引重新索引到另一個索引,索引映射更改以及分析分析,或將索引升級到新的主要版本等功能
4	索引自動修復

PUT doc_source_index/_doc/1
{
  "text":"doc source enabled test3"
}

//_update_by_query功能不再支持,[doc_source_index][_doc][1] didn't store _source
POST doc_source_index/_update_by_query

//_update功能不再支持,[_doc][1]: document source missing
POST doc_source_index/_update/1
{
  "doc":{
    "text":"test update"
  }
}
//同上
POST doc_source_index/_update/1
{
  "script": "ctx._source.text = 'test update'"
}

指定_source字段對應值包含/不包含的字段
在文檔被索引之後且_source字段存儲之前可以對_source字段進行修剪以滿足特定場景;

tips:從_source字段中移除字段與禁用_source存在相同的缺點,尤其是無法將文檔從一個ES重新索引到另外一個ES中,可以考慮使用_source過濾條件替代;

//includes/excludes參數支持通配符,以下包含以count結尾,meta開頭的(排除meta.desc,meta.other.*)
PUT doc_source_ie_index
{
  "mappings": {
    "_source": {
      "includes": [
        "*.count",
        "meta.*"
      ],
      "excludes": [
        "meta.desc",
        "meta.other.*"
      ]
    }
  }
}


PUT doc_source_ie_index/_doc/1
{
  "request":{
    "count":10,
    "foo":"bar"
  },
  "meta":{
    "name":"es _source",
    "desc":"es _source includes/excludes",
    "other":{
      "foo":"one",
      "baz":"two"
    }
  }
}

//meta.other.foo該字段雖然不在_source展示字段中,但是其依然建立了索引,故而可以根據這個條件查詢
GET doc_source_ie_index/_search
{
  "query": {
    "match": {
      "meta.other.foo": "one"
    }
  }
}

_type字段

_type字段在ES的6.0.0版本中已經標記爲過期;
每個文檔都會被指定一個_type字段和一個_id字段,對_type字段索引是爲了通過名稱能更快查詢;

PUT doc_type_index/_doc/1
{
  "text":"doc with type '_doc'"
}

PUT doc_type_index/_doc/2
{
  "text":"it's a nice day"
}

//提示信息:Deprecation: [types removal] Using the _type field in queries and aggregations is deprecated, prefer to use a field instead.
//提示信息:Deprecation: [types removal] Looking up doc types [_type] in scripts is deprecated.
//同_id字段一樣,建議如果需要建一個字段代替原來表示索引類型
GET doc_type_index/_search
{
  "query": {
    "term": {
      "_type": {
        "value": "_doc"
      }
    }
  },
  "aggs": {
    "types": {
      "terms": {
        "field": "_type",
        "size": 10
      }
    }
  },
  "sort": [
    {
      "_type": {
        "order": "desc"
      }
    }
  ],
  "script_fields": {
    "type": {
      "script": {
        "lang": "painless",
        "source": "doc['_type']"
      }
    }
  }
}