Elasticsearch中的基本的查询代码

ES中基本的查询代码, 持续补充中

# 查看所有索引列表
GET /_cat/indices

# 搜索全部, 默认返回10个
GET /_search
GET /_all/_search

# 同时搜索多个索引(多个之间不要加空格!!)
GET twitter*/_search
GET twitter,twitter1/_search

# 同时搜索多个, 但是要排除某几个索引
GET twitter*,-twitter1/_search

# 搜索全部, 指定分页大小`size`和偏移量`from`(从0开始)
GET /_search?size=100&from=76

# 搜索指定的索引, 指定分页大小`size`
GET twitter/_search?size=20

# 控制输出较少的字段
GET twitter/_search?filter_path=hits.total
GET twitter/_search?filter_path=hits.hits

# 指定要返回的字段
GET twitter/_search
{
  "_source": "user"
}
GET twitter/_search
{
  "_source": ["user", "city"]
}
GET twitter/_search
{
  "_source": ["u*", "city"]
}

# 增加返回的栏位 `script_fields`
GET twitter/_search
{
  "script_fields": {
    "years_to_100": {
      "script": {
        "lang": "painless",
        "source": "100 - doc['age'].value"
      }
    },
    "year_of_birth":{
      "script": "2019 - doc['age'].value"
    }
  }
}

# 计数 `_count`
GET twitter/_count


# 查看索引的字段类型
GET twitter/_mapping

# 普通词语匹配查询 `match`
GET twitter/_search?size=20
{
  "query":{
    "match": {
      "message": "happy"
    }
  }
}
# 词语前缀匹配查询: prefix
GET twitter/_search
{
  "query": {
    "prefix": {
      "user": "老"
    }
  }
}
GET twitter/_search
{
  "query": {
    "prefix": {
      "user": {
        "value": "老"
      }
    }
  }
}

# 所有单词必须都出现: `match` + `operator`
GET twitter/_search
{
  "query":{
    "match": {
      "message": {
        "query": "happy birthday",
        "operator": "and"
      }
    }
  }
}

# 至少要同时匹配几个单词: `match` + `minimum_should_match`
GET twitter/_search
{
  "query":{
    "match": {
      "message": {
        "query": "happy birthday",
        "minimum_should_match": 2
      }
    }
  }
}

# 按先后顺序匹配查询: match_phrase
GET twitter/_search
{
  "query":{
    "match_phrase": {
      "message": "Happy birthday"
    }
  }
}
# 允许单词之间有几个单词: `match_phrase` + `slop`
GET twitter/_search
{
  "query":{
    "match_phrase": {
      "message": {
        "query": "Happy my",
        "slop": 1
      }
    }
  }
}

# 范围查询
GET twitter/_search
{
  "query":{
    "range": {
      "age": {
        "gte": 30,
        "lte": 40
      }
    }
  }
}

# 位置查询
GET twitter/_search
{
  "query":{
    "match": {
      "age": 30
    }
  },
  "post_filter": {
    "geo_distance": {
      "distance": "30km",
      "location": {
        "lat": 39.920086,
        "lon": 116.454182
      }
    }
  }
}

# 通配符查询 `wildcard`
GET twitter/_search
{
  "query":{
    "wildcard": {
      "city.keyword": {
        "value": "*海"
      }
    }
  }
}

# SQL查询
GET /_sql?
{
  "query":"""
  SELECT * FROM twitter
  WHERE age=30
  """
}
GET /_sql?
{
  "query":"""
  SELECT * FROM twitter
  WHERE message LIKE '%happy%'
  """
}

彩蛋

1. _search默认最多只能查看结果的前10000笔记录, offset超过就会报错400

  "hits" : {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
	....

当使用类似 GET kibana_sample_data_logs/_search?size=10&from=9991 条件搜索时, 会报错:

    "root_cause" : [
      {
        "type" : "illegal_argument_exception",
        "reason" : "Result window is too large, from + size must be less than or equal to: [10000] but was [10001]. See the scroll api for a more efficient way to request large data sets. This limit can be set by changing the [index.max_result_window] index level setting."
      }
    ],
    "type" : "search_phase_execution_exception",
....

意思就是 from + size <=10000

2. 栏位(FIELD)区分大小写

当我们把twitter的栏位city错写成City时搜索不到结果, 而且当前的7.7版本也不报错

GET twitter/_search
{
  "query": {
    "match": {
      "City": "北京"
    }
  }
}

3. 关于字符串的类型

5.0以后，string类型有重大变更，移除了string类型，string字段被拆分成两种新的数据类型: text用于全文搜索的,而keyword用于关键词搜索。

ElasticSearch字符串将默认被同时映射成text和keyword类型，将会自动创建类似下面的动态映射(dynamic mappings):

{
    "message": {
        "type": "text",
        "fields": {
            "keyword": {
                "type": "keyword",
                "ignore_above": 256
            }
        }
    }
}

这就是造成部分字段还会自动生成一个与之对应的“keyword”字段的原因。

• text：会分词，然后进行索引, 支持模糊、精确查询, 不支持聚合
• keyword：不进行分词，直接索引, 支持模糊、精确查询, 支持聚合