Elasticsearch学习笔记

初识Elasticsearch：

1 启动ES
su elasticsearch
/hadoop/elasticsearch-2.4.3/bin/elasticsearch -d


(注：若无账号则创建账号
创建用户：adduser elasticsearch
赋予可执行权限：chown -R elasticsearch /hadoop/elasticsearch-2.4.3
)


--查看进程
ps aux|grep elasticsearch


2 查看节点信息
curl 'http://127.0.0.1:9200/_cat/nodes?v'


3 查看全部索引
curl 'http://127.0.0.1:9200/_cat/indices?v'


4 创建索引
curl -XPUT 'http://127.0.0.1:9200/mytest?pretty'


--删除索引
curl -XDELETE 'http://127.0.0.1:9200/mytest?pretty'


5 插入数据
curl -XPUT 'http://127.0.0.1:9200/mytest/external/1?pretty' -d '{"name": "John Doe"}'
curl -XPUT 'http://127.0.0.1:9200/mytest/external/5?pretty' -d '{"name": "Tom"}'

curl -XPOST 'http://127.0.0.1:9200/mytest/external/1/_update?pretty' -d '{"doc": { "age": 20 }}'
curl -XPOST 'http://127.0.0.1:9200/mytest/external/2/_update?pretty' -d '{"doc": { "age": 25 }}'
curl -XPOST 'http://127.0.0.1:9200/mytest/external/3/_update?pretty' -d '{"doc": { "age": 30 }}'

6 删除
curl -XDELETE 'http://127.0.0.1:9200/mytest/external/2?pretty'


curl -XDELETE 'http://127.0.0.1:9200/mytest/external/_query?pretty' -d '
    {
      "query": { "match": { "name": "John" } }
    }'

7 查询 match 是模糊查询 term 是精确查询 
curl -XGET 'http://127.0.0.1:9200/mytest/external/1?pretty'


curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"from":"0","size":"6"}'


curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"match":{"srcip":"221.176.67.103"}}}'


curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"match":{"srcport":"0"}}}'


--模糊匹配
curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"match_phrase":{"name":"名字是张三"}}}'


curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"term":{"name":"名字是李四"}}}'


curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"bool":{"must":{"term":{"name":"名字是李四"}}}}}'


--精确匹配
curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"bool":
{
"must":{"term":{"name":"名"}},
"must":{"term":{"name":"字"}},
"must":{"term":{"name":"是"}},
"must":{"term":{"name":"李"}},
"must":{"term":{"name":"四"}}
}
}}'


curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"bool":
{
"must":{"term":{"name":"名"}},
"must":{"term":{"name":"字"}},
"must":{"term":{"name":"是"}},
"must":{"term":{"name":"李"}}
}
}}'


curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"bool":{"must_not":{"term":{"age":20}},"must":{"term":{"name":"张三"}}}}}'




8 多条件查询 
curl -XGET 'http://127.0.0.1:9200/event/event/_search?pretty' -d '{"query": {"bool": {"should": [{ "match": { "sourceip":  "221.176.67.10" }},{ "match": { "destip": "221.176.67.101"   }}]}}}'


curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query": {"bool": {"should": [{ "match": { "name":  "名字是" }},{ "match": { "name": "张三"   }}]}}}'


9 按时间查询
curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"range":{"opentime":{"gte":"1495414800000"}}}}'
curl -XGET 'http://127.0.0.1:9200/mytest/external/_search?pretty' -d '{"query":{"range":{"opentime":{"gte":"1495697415000","lte":"1495697415000"}}}}'


10 聚合
curl -XGET '172.16.10.74:9200/event/event/_search?pretty'  -d'
{
   "size" : 0,
   "aggs": {
      "sales": {
         "date_histogram": {
            "field": "opentime",
            "interval": "month", 
            "format": "yyyy-MM-dd" 
         }
      }
   }
}
'