kibana Dev Tools语句查询简单使用入门
使用kibana7.0.0的控制台Dev Tools操作ES数据的基本语法入门示例
因为使用的是本地启动的ES库，所以需要先启动ES，然后启动kibana，直接从官网上下载安装启动即可，说明一点就是需先启动ES，在启动kibana，该部分效果以及添加官方示例数据已在之前一篇文章中写过，此处不再重复。
直接点击Dev Tools，来看基本操作
1，输入：GET /
在右侧将看到和启动完ES后在浏览器输入localhost:9200相同的内容
2，创建索引
输入：
说明：因为7版本之后，ES不再支持一个索引（index）可以创建多个类型（type），所以cmcc/后边不再需要写入类型名称，而是统一使用_create代替即可，同样的，查询操作使用_doc代替即可，右侧看到如下图所示类似形式表示创建成功
3，查看刚才创建的索引
输入：GET cmcc/_doc/1
右侧将显示刚才创建的内容，其中_index是刚才创建的索引名称；_type是类型，7版本统一为_doc；_id为创建时的ID，如果创建索引的时候不设置ID，那么ES将默认分配一个ID，不过样式会比较长，不好记忆；_version为版本号，如果我们之后对该数据进行了修改，那么他会随之变化；_source里边就是我们刚才加进去的数据内容
4，删除索引
输入：DELETE cmcc
只需要在DELETE后边加上索引名称即可
5，修改数据
输入：
这里我们修改了"name"值，把"province"和"conutry"值改为中文，并添加了一个新属性"xingbie"，执行之后我们再次执行获取数据内容命令GET cmcc/_doc/1，如下，可以看到数据已经被修改，版本号变成了2
6，bulk方法批量插入数据
输入：
使用POST方法，然后每一条数据的格式是一致的，首先第一行输入 {"index":{"_index":"cmcc"}} ，也就是索引名称，第二行输入要插入的完整数据，这里特别提醒下，插入的这条数据不能使用刚才创建数据时的那种多行形式，只能使用没有回车的一条数据，否则会报错如下：
{
"error": {
"root_cause": [
{
"type": "json_e_o_f_exception",
"reason": "Unexpected end-of-input: expected close marker for Object (start marker at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@154857fc; line: 1, column: 1])\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@154857fc; line: 1, column: 3]"
}
],
"type": "json_e_o_f_exception",
"reason": "Unexpected end-of-input: expected close marker for Object (start marker at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@154857fc; line: 1, column: 1])\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@154857fc; line: 1, column: 3]"
},
"status": 500
}执行完毕后，我们再次获取数据看一下，输入：GET cmcc/_search
结果如下：（不截长图了，就直接贴结果吧>_<）
{
"took" : 374,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 5,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "1",
"_score" : 1.0,
"_source" : {
"name" : "dunkking",
"age" : 27,
"location" : "SG",
"province" : "河北",
"country" : "中国",
"xingbie" : "mela"
}
},
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "9vD-3moBmjOHTfOJtVLL",
"_score" : 1.0,
"_source" : {
"name" : "points",
"age" : 23,
"location" : "PG",
"province" : "江苏",
"country" : "中国",
"xingbie" : "mela"
}
},
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "9_D-3moBmjOHTfOJtVLL",
"_score" : 1.0,
"_source" : {
"name" : "rebound",
"age" : 24,
"location" : "SF",
"province" : "广州",
"country" : "中国",
"xingbie" : "mela"
}
},
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "-PD-3moBmjOHTfOJtVLL",
"_score" : 1.0,
"_source" : {
"name" : "center",
"age" : 23,
"location" : "C",
"province" : "北京",
"country" : "中国",
"xingbie" : "femela"
}
},
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "-fD-3moBmjOHTfOJtVLL",
"_score" : 1.0,
"_source" : {
"name" : "assist",
"age" : 21,
"location" : "PF",
"province" : "广州",
"country" : "中国",
"xingbie" : "famela"
}
}
]
}
}7，按照条件查询
输入：
也就是查询数据中属性"province"为"广州"的数据，结果如下：
{
"took" : 10,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 2,
"relation" : "eq"
},
"max_score" : 1.7509375,
"hits" : [
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "9_D-3moBmjOHTfOJtVLL",
"_score" : 1.7509375,
"_source" : {
"name" : "rebound",
"age" : 24,
"location" : "SF",
"province" : "广州",
"country" : "中国",
"xingbie" : "mela"
}
},
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "-fD-3moBmjOHTfOJtVLL",
"_score" : 1.7509375,
"_source" : {
"name" : "assist",
"age" : 21,
"location" : "PF",
"province" : "广州",
"country" : "中国",
"xingbie" : "famela"
}
}
]
}
}8，当同一个属性满足逻辑或时的查询
输入：
这里是查询属性"age"等于21或者23的数据，如果看着不舒服，我们可以点击运行按钮右侧的扳手，选择Auto indent，输入效果就会直观一些，
其中，116行固定输入"query"，117行固定输入"bool"，118行输入为"should"，表示是逻辑或的关系，120行为"match"，121行为所要查询的属性名与属性值
执行结果如下
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 3,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "9vD-3moBmjOHTfOJtVLL",
"_score" : 1.0,
"_source" : {
"name" : "points",
"age" : 23,
"location" : "PG",
"province" : "江苏",
"country" : "中国",
"xingbie" : "mela"
}
},
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "-PD-3moBmjOHTfOJtVLL",
"_score" : 1.0,
"_source" : {
"name" : "center",
"age" : 23,
"location" : "C",
"province" : "北京",
"country" : "中国",
"xingbie" : "femela"
}
},
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "-fD-3moBmjOHTfOJtVLL",
"_score" : 1.0,
"_source" : {
"name" : "assist",
"age" : 21,
"location" : "PF",
"province" : "广州",
"country" : "中国",
"xingbie" : "famela"
}
}
]
}
}9，多条件查询
输入：
这里是查询属性"age"等于23，并且属性"country"为“中国”的数据，这里和上一条查询的关键区别就在于第98行由"should"改为"must"，执行结果如下：
{
"took" : 1,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 2,
"relation" : "eq"
},
"max_score" : 1.1740228,
"hits" : [
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "9vD-3moBmjOHTfOJtVLL",
"_score" : 1.1740228,
"_source" : {
"name" : "points",
"age" : 23,
"location" : "PG",
"province" : "江苏",
"country" : "中国",
"xingbie" : "mela"
}
},
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "-PD-3moBmjOHTfOJtVLL",
"_score" : 1.1740228,
"_source" : {
"name" : "center",
"age" : 23,
"location" : "C",
"province" : "北京",
"country" : "中国",
"xingbie" : "femela"
}
}
]
}
}10，范围查询并进行排序
输入：
这里，151行使用"range"，152行输入属性名，153行"gte"和154行"lte"表示查询属性"age"在20-25范围的数据，然后158行表示排序，160行表示排序的属性是"age"，161“order”表示排序为倒序"desc"，执行结果如下：
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 4,
"relation" : "eq"
},
"max_score" : null,
"hits" : [
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "9_D-3moBmjOHTfOJtVLL",
"_score" : null,
"_source" : {
"name" : "rebound",
"age" : 24,
"location" : "SF",
"province" : "广州",
"country" : "中国",
"xingbie" : "mela"
},
"sort" : [
24
]
},
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "9vD-3moBmjOHTfOJtVLL",
"_score" : null,
"_source" : {
"name" : "points",
"age" : 23,
"location" : "PG",
"province" : "江苏",
"country" : "中国",
"xingbie" : "mela"
},
"sort" : [
23
]
},
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "-PD-3moBmjOHTfOJtVLL",
"_score" : null,
"_source" : {
"name" : "center",
"age" : 23,
"location" : "C",
"province" : "北京",
"country" : "中国",
"xingbie" : "femela"
},
"sort" : [
23
]
},
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "-fD-3moBmjOHTfOJtVLL",
"_score" : null,
"_source" : {
"name" : "assist",
"age" : 21,
"location" : "PF",
"province" : "广州",
"country" : "中国",
"xingbie" : "famela"
},
"sort" : [
21
]
}
]
}
}11，聚合查询
输入：
使用聚合查询，格式是：170行使用"aggs"，171行为所要查询的属性名，这里查询"age"，173行"field"后边输入属性名，174行为范围，分别在"from"和"to"后边输入要分段的范围，这条请求实现的是统计属性"age"按照20-23,23-25,25-30划分的数据条数分别为多少，如果想要查看满足条件的数据，则将169行"size"值置为非零数，貌似应大于查询条数，具体还没查，这里是不显示满足条件的具体数据，直接置零即可，执行结果如下：
{
"took" : 9,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 5,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"age" : {
"buckets" : [
{
"key" : "20.0-23.0",
"from" : 20.0,
"to" : 23.0,
"doc_count" : 1
},
{
"key" : "23.0-25.0",
"from" : 23.0,
"to" : 25.0,
"doc_count" : 3
},
{
"key" : "25.0-30.0",
"from" : 25.0,
"to" : 30.0,
"doc_count" : 1
}
]
}
}
}聚合查询的另外一个示例
输入：
这条请求是查询属性"province"的统计结果，这里是统计5条数据，并显示其中2条，并在197行"field"后输入属性名，并在其后添加 .keyword，查询结果如下
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 5,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "1",
"_score" : 1.0,
"_source" : {
"name" : "dunkking",
"age" : 27,
"location" : "SG",
"province" : "河北",
"country" : "中国",
"xingbie" : "mela"
}
},
{
"_index" : "cmcc",
"_type" : "_doc",
"_id" : "9vD-3moBmjOHTfOJtVLL",
"_score" : 1.0,
"_source" : {
"name" : "points",
"age" : 23,
"location" : "PG",
"province" : "江苏",
"country" : "中国",
"xingbie" : "mela"
}
}
]
},
"aggregations" : {
"province" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "广州",
"doc_count" : 2
},
{
"key" : "北京",
"doc_count" : 1
},
{
"key" : "江苏",
"doc_count" : 1
},
{
"key" : "河北",
"doc_count" : 1
}
]
}
}
}暂时写这么多，刚开始学，很多不熟悉的，后续有时间慢慢补充