Elasticsearch中的基本的查詢代碼

ES中基本的查詢代碼, 持續補充中

# 查看所有索引列表
GET /_cat/indices

# 搜索全部, 默認返回10個
GET /_search
GET /_all/_search

# 同時搜索多個索引(多個之間不要加空格!!)
GET twitter*/_search
GET twitter,twitter1/_search

# 同時搜索多個, 但是要排除某幾個索引
GET twitter*,-twitter1/_search

# 搜索全部, 指定分頁大小`size`和偏移量`from`(從0開始)
GET /_search?size=100&from=76

# 搜索指定的索引, 指定分頁大小`size`
GET twitter/_search?size=20

# 控制輸出較少的字段
GET twitter/_search?filter_path=hits.total
GET twitter/_search?filter_path=hits.hits

# 指定要返回的字段
GET twitter/_search
{
  "_source": "user"
}
GET twitter/_search
{
  "_source": ["user", "city"]
}
GET twitter/_search
{
  "_source": ["u*", "city"]
}

# 增加返回的欄位 `script_fields`
GET twitter/_search
{
  "script_fields": {
    "years_to_100": {
      "script": {
        "lang": "painless",
        "source": "100 - doc['age'].value"
      }
    },
    "year_of_birth":{
      "script": "2019 - doc['age'].value"
    }
  }
}

# 計數 `_count`
GET twitter/_count


# 查看索引的字段類型
GET twitter/_mapping

# 普通詞語匹配查詢 `match`
GET twitter/_search?size=20
{
  "query":{
    "match": {
      "message": "happy"
    }
  }
}
# 詞語前綴匹配查詢: prefix
GET twitter/_search
{
  "query": {
    "prefix": {
      "user": "老"
    }
  }
}
GET twitter/_search
{
  "query": {
    "prefix": {
      "user": {
        "value": "老"
      }
    }
  }
}

# 所有單詞必須都出現: `match` + `operator`
GET twitter/_search
{
  "query":{
    "match": {
      "message": {
        "query": "happy birthday",
        "operator": "and"
      }
    }
  }
}

# 至少要同時匹配幾個單詞: `match` + `minimum_should_match`
GET twitter/_search
{
  "query":{
    "match": {
      "message": {
        "query": "happy birthday",
        "minimum_should_match": 2
      }
    }
  }
}

# 按先後順序匹配查詢: match_phrase
GET twitter/_search
{
  "query":{
    "match_phrase": {
      "message": "Happy birthday"
    }
  }
}
# 允許單詞之間有幾個單詞: `match_phrase` + `slop`
GET twitter/_search
{
  "query":{
    "match_phrase": {
      "message": {
        "query": "Happy my",
        "slop": 1
      }
    }
  }
}

# 範圍查詢
GET twitter/_search
{
  "query":{
    "range": {
      "age": {
        "gte": 30,
        "lte": 40
      }
    }
  }
}

# 位置查詢
GET twitter/_search
{
  "query":{
    "match": {
      "age": 30
    }
  },
  "post_filter": {
    "geo_distance": {
      "distance": "30km",
      "location": {
        "lat": 39.920086,
        "lon": 116.454182
      }
    }
  }
}

# 通配符查詢 `wildcard`
GET twitter/_search
{
  "query":{
    "wildcard": {
      "city.keyword": {
        "value": "*海"
      }
    }
  }
}

# SQL查詢
GET /_sql?
{
  "query":"""
  SELECT * FROM twitter
  WHERE age=30
  """
}
GET /_sql?
{
  "query":"""
  SELECT * FROM twitter
  WHERE message LIKE '%happy%'
  """
}

彩蛋

1. _search默認最多隻能查看結果的前10000筆記錄, offset超過就會報錯400

  "hits" : {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
	....

當使用類似 GET kibana_sample_data_logs/_search?size=10&from=9991 條件搜索時, 會報錯:

    "root_cause" : [
      {
        "type" : "illegal_argument_exception",
        "reason" : "Result window is too large, from + size must be less than or equal to: [10000] but was [10001]. See the scroll api for a more efficient way to request large data sets. This limit can be set by changing the [index.max_result_window] index level setting."
      }
    ],
    "type" : "search_phase_execution_exception",
....

意思就是 from + size <=10000

2. 欄位(FIELD)區分大小寫

當我們把twitter的欄位city錯寫成City時搜索不到結果, 而且當前的7.7版本也不報錯

GET twitter/_search
{
  "query": {
    "match": {
      "City": "北京"
    }
  }
}

3. 關於字符串的類型

5.0以後，string類型有重大變更，移除了string類型，string字段被拆分成兩種新的數據類型: text用於全文搜索的,而keyword用於關鍵詞搜索。

ElasticSearch字符串將默認被同時映射成text和keyword類型，將會自動創建類似下面的動態映射(dynamic mappings):

{
    "message": {
        "type": "text",
        "fields": {
            "keyword": {
                "type": "keyword",
                "ignore_above": 256
            }
        }
    }
}

這就是造成部分字段還會自動生成一個與之對應的“keyword”字段的原因。

• text：會分詞，然後進行索引, 支持模糊、精確查詢, 不支持聚合
• keyword：不進行分詞，直接索引, 支持模糊、精確查詢, 支持聚合