elasticsearch搜索与聚合常用DSL语句
主要了解query、bool（must、should、must_not）、term、match、range、filter、size、from、cardinality等。
换句话说需要了解索引、类型、分词查询、精确查询、全文查询、排序、去重、求最大值、平均值、分页等，其实和数据库蛮相似的，理解着学习就好。
下面是一些elasticsearch教程和参考的一些常用语法例子。
https://es.xiaoleilu.com/
https://blog.csdn.net/u014589856/article/details/78135762
https://www.cnblogs.com/leeSmall/p/9215909.html
下面是常用到的一些DSL语句例子：
//查看集群相关信息
GET _cluster/health
//查看集群信息里的索引清单，以及有关每个索引的细节（状态、分片数、未分配分片数等等）
GET _cluster/health?level=indices
//查询所有的索引名称和健康信息：
GET /_cat/indices
//查看指定索引下所有字段及字段类型
GET customer/_mapping
//查询所有索引的别名：
GET /_alias
//查看索引customer_vhx的别名
GET customer_vhx/_alias/
//查看集群健康
GET /_cat/health?v
//集群中节点列表
GET /_cat/nodes?v
-------------------------------搜索---------------------------------------------------------------------------------------------------------------------------------------------------------
//添加一个记录
PUT /megacorp/employee/1 //megacorp为索引名，employee为记录名，1为id。若没有索引名、记录名则创建再添加
{
"first_name" : "John", //first_name、last_name、age等都为字段，对应的是具体的值
"last_name" : "Smith",
"age" : 25,
"about" : "I love to go rock climbing",
"interests": [ "sports", "music" ]
}
//简单查询索引为megacorp，记录为employee，id为1的记录
GET /megacorp/employee/1
//简单查询所有employee信息
GET /megacorp/employee/_search
//简单查询last_name字段为Smith的记录，q为变量
GET /megacorp/employee/_search?q=last_name:Smith
//DSL查询last_name字段为Smith的记录
GET /megacorp/employee/_search
{
"query" : { //query查找
"match" : { //match匹配属于分词匹配（除了match还有match_prase和match_all），term匹配属于精确匹配
"last_name" : "Smith"
}
}
}
//DSL查询last_name字段为tao的记录
GET /megacorp/employee/_search
{
"query" : { //query查找
"term" : { //term匹配属于精确匹配
"last_name" : "tao"
}
}
}
//DSL查询bool语句。如果bool语句中must不存在，则必须至少有一个should
GET /megacorp/ employee/_search
{
"query": { //查询
"bool": {
"must": {
"match": {
"last_name": "Smith"
}
},
"filter": { //查询的同时通过filter过滤出符合年龄为32的现实
"term": {
"age": 32
}
}
}
}
}
//DSL查询年龄大于32的
GET /megacorp/ employee/_search
{
"query”: {
"bool": {
"filter": {
"range": {
"age": {
"gt": 32
}
}
}
}
}
}
//DSL排序
GET /megacorp/ employee/_search
{
"sort": [
{
"age": { //按照年龄排序
"order": "desc"
}
}
]
}
-------------------------------聚合---------------------------------------------------------------------------------------------------------------------------------------------------------
//求age最大值
GET /megacorp/ employee/_search
{
"size": 0,
"aggs": { //表示聚合
"test": { //自己起的聚合名
"max": {
"field": "age" //字段为age
}
}
}
}
//求age平均值
POST /megacorp/ employee/_search
{
"aggs": {
"avg_age": {
"avg": { //求age平均值，若没有age的age指定为23再计算
"field": "age",
"missing": 23
}
}
}
}
//stats 统计age的 count max min avg sum 5个值
POST /megacorp/ employee/_search
{
"aggs": {
"age_stats": {
"stats": {
"field": "age"
}
}
}
}
//terms字段值分组聚合，默认情况下返回按文档计数从高到低的前10个分组
POST /megacorp/ employee/_search
{
"aggs": {
"age_terms": {
"terms": { //根据字段值分组聚合，结果 "key": 23,"doc_count": 2意思是年龄为23的文档有2个
"field": "age"，
"size": 2 //返回一个分组，没有这句则默认返回按文档计数从高到低的前10个分组
}
}
}
}
//cardinality去重
POST /megacorp/ employee/_search
{
"aggs": {
"group_test": {
"cardinality": { //去重计算age的人数
"field": "age"
}
}
}
}
实例：
假如A、B、C三个人，每个人的文档里的one_account.one_account_no都是1489，那么统计A、B、C的总资产的和.
下面的示例统计具有相同one_account.one_account_no是1489、1488、110600000858的总资产的和：
GET customer/_search
{
"size": 0,
"query": {
"bool": {
"filter": [
{
"terms": {
"one_account.one_account_no": [
"1489",
"1488",
"110600000858"
]
}
}
]
}
},
"aggregations": {
"statistics_assets": {
"terms": {
"field": "one_account.one_account_no",
"size": 10
},
"aggregations": {
"assets": {
"sum": {
"field": "assets.merge"
}
}
}
}
}
}
结果：
{
"took" : 1,
"timed_out" : false,
"_shards" : {
"total" : 6,
"successful" : 6,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 14,
"max_score" : 0.0,
"hits" : [ ]
},
"aggregations" : {
"statistics_assets" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "1488",
"doc_count" : 7,
"assets" : {
"value" : 62683.2
}
},
{
"key" : "1489",
"doc_count" : 6,
"assets" : {
"value" : 9.805486535E7
}
},
{
"key" : "110600000858",
"doc_count" : 1,
"assets" : {
"value" : 9.805486522E7
}
}
]
}
}
}
可以看到one_account.one_account_no是1488的文档有7个，7个文档总资产相加是62683.2
Java代码：
//获取当前页的所有一户通号，并通过一户通号聚合该一户通下的客户总资产
List<String> list = new ArrayList<>();
list.add("1489");
list.add("1488");
list.add("110600000858");
SearchRequest searchRequest = new SearchRequest("customer");
searchRequest.types("customer_info");
BoolQueryBuilder boolAssetBuilder = QueryBuilders.boolQuery();
boolAssetBuilder.filter(QueryBuilders.termsQuery("one_account.one_account_no",list));
SearchSourceBuilder searchAssetBuilder = new SearchSourceBuilder();
searchAssetBuilder.timeout(new TimeValue(60, TimeUnit.SECONDS));
searchAssetBuilder.size(pageSize);
searchAssetBuilder.query(boolAssetBuilder);
AggregationBuilder assetsAggregation = AggregationBuilders.sum("assets").field("assets.merge");
AggregationBuilder AggregationBuilder1 = AggregationBuilders.terms("statistics_assets").field("one_account.one_account_no").size(pageSize).subAggregation(assetsAggregation);
searchAssetBuilder.aggregation(AggregationBuilder1);
searchRequest.source(searchAssetBuilder);
SearchResponse searchAssetsResponse = null;
try {
searchAssetsResponse = restHighLevelClient.search(searchRequest);
} catch (IOException e) {
e.printStackTrace();
}
Map<String, String> map = new HashMap<>();//存储es返回的所有的key和value
List<Aggregation> aggList = searchAssetsResponse.getAggregations().asList();
List<? extends Terms.Bucket> buckets = new ArrayList<>();
if (!CollectionUtils.isEmpty(aggList) && aggList.get(0).getName().equals("statistics_assets")){
buckets =((ParsedStringTerms) aggList.get(0)).getBuckets();
}
for (int i = 0; i < buckets.size(); i++) {
List<Aggregation> assetsAggList =((ParsedStringTerms.ParsedBucket) buckets.get(i)).getAggregations().asList();
ParsedSum sum = (ParsedSum)assetsAggList.get(0);
double assetsValueDouble = sum.getValue();
//总资产科学计数法转字符串
BigDecimal bd = new BigDecimal(String.valueOf(assetsValueDouble));
String assetsValue = bd.toPlainString();
String oneAccountNo = ((ParsedStringTerms.ParsedBucket) buckets.get(i)).getKeyAsString();
map.put(oneAccountNo,assetsValue);
}