es6.6.2操作索引和文档的命令

标准的创建索引方法,这种方式是创建索引的时候,动态指定mapping映射,作用是让索引建立得更细致和完善:

curl -H "Content-Type:application/json" -XPUT 'http://IP地址:端口/xxx_log' -d '{"aliases" : { },"mappings" : {"dat_xxxx_log" : {"_all": {"enabled": false},"properties" : {"@timestamp" : {"type" : "date"},"@version" : {"type" : "keyword"},"oper_ip" : {"type" : "keyword"},"oper_user" : {"type" : "keyword"},"oper_time" : {"type" : "long"},"oper_type" : {"type" : "keyword"},"oper_context" : {"type" : "text","fielddata" : true}}}},"settings" : {"index" : {"codec" : "best_compression","number_of_shards" : "8","number_of_replicas" : "0","refresh_interval" : "10s","sort.field": ["oper_time"],"sort.order":["asc"]}}}'

 


查询索引
curl -XGET 'http://IP:PORT/screen_video_index/_search?q=*&pretty'


删除文档
curl -XDELETE http://IP:PORT/screen_video_index/screen_video_type/ciixg2wBtxTfQOUp9tt7/

1、感觉不加双引号也行。 2、ciixg2wBtxTfQOUp9tt7是id号


添加文档
curl -H 'Content-Type:application/json' -XPOST 'http://IP:PORT/screen_video_index/screen_video_type' -d
'{"operate_time":"2019-08-09 08:19:08", "context":"删除文件夹", "operate_user":"huangxiaodi"}'

添加文档后,id是默认生成的序列号

你可能感兴趣的:(ELK)