Elasticsearch是一个分布式RESTful风格的搜索和数据分析引擎
Elasticsearch是一个高度可伸缩的开源全文搜索和分析引擎。它允许你快速和接近实时的存储、搜索和分析大量的数据
请求：
curl -X GET "localhost:9200/_cat/health?v"
响应：
epoch timestamp cluster status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent
1569298977 04:22:57 elasticsearch_mac green 1 1 0 0 0 0 0 0 - 100.0%
在这里面可以看到我们命名的"elasticsearch_mac"的集群现在是green状态。无论什么时候我们请求集群健康的时候，我们会得到green、yellow或者是red
上面的这些响应我们可以看到，集群elasticsearch_mac总共只有一个节点，零个分片，因为还没有数据
查看全部所有的索引：
curl -X PUT "localhost:9200/customer?pretty"
ps：pretty的意思是响应（如果有的话）以JSON格式返回
响应：
{ "acknowledged" : true, "shards_acknowledged" : true, "index" : "customer" }
请求：
curl -X GET "localhost:9200/_cat/indices?v"
响应：
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
yellow open customer j_ybcHPwSdujNhRH6wrZrA 1 1 0 0 230b 230b
结果的第二行告诉我们，我们现在有一个叫customer的索引，他有1个主分片和1个副本（默认是一个副本），有0个文档
在这里customer索引的状态是yellow。也就意味着一些副本尚未被分配
之所以会出现这种情况是因为Elasticsearch默认情况下为了这个索引创建了一个副本。但是由于目前我们只有一个节点在运行，所以直到稍后另一个节点加入到集群中时，才会分配一个副本（对于高可用性）。一旦该副本分配到第二个节点上，那么该索引的状态就会变成green了
现在我们put一些数据到customer索引
请求：
curl -X PUT "localhost:9200/customer/_doc/1?pretty" -H ‘Content-Type: application/json‘ -d‘{"name": "1213William"}‘
响应：
{ "_index" : "customer", "_type" : "_doc", "_id" : "1", "_version" : 1, "result" : "created", "_shards" : { "total" : 2, "successful" : 1, "failed" : 0 }, "_seq_no" : 0, "_primary_term" : 1 }
从上面的这个响应可以看出来，我们在customer索引下面成功创建了一个文档，这个文档还有一个内部id为1，这是我们在创建的时候指定的
需要注意的是，Elasticsearch并不是要求你在索引文档之前就先创建索引，然后才能将文档编入索引。在前面的例子中，如果事先不存在customer索引，那么Elasticsearch就会自动创建customer索引 --> 也就是说在新建文档的时候如果指定的索引不存在就会自动创建相应的索引
现在我们重新检索这个文档
请求：
curl -X GET "localhost:9200/customer/_doc/1?pretty"
响应：
{ "_index" : "customer", "_type" : "_doc", "_id" : "1", "_version" : 1, "_seq_no" : 0, "_primary_term" : 1, "found" : true, "_source" : { "name" : "1213William" } }
在这个响应中可以看到除了found字段外没有什么不同，‘_source‘字段返回了一个完整的JSON文档
现在让我们删除前面创建的索引，然后查看全部的索引
请求：
curl -X DELETE "localhost:9200/customer?pretty"
响应：
{ "acknowledged" : true }
接下来查看一下：
curl -X GET "localhost:9200/_cat/indices?v"
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
curl -X DELETE "localhost:9200/customer" # 删除索引 curl -X GET "localhost:9200/customer/_doc/1" # 查询文档 curl -X PUT "localhost:9200/customer" # 创建索引 curl -X PUT "localhost:9200/customer/_doc/1" -H ‘Content-Type: application/json‘ -d‘{"name": "1213William"}‘ # 索引文档
我们研究可以发现在Elasticsearch中的访问数据的模式其实就是：
<REST Verb> /<Index>/<Type>/<ID>
每当我们在执行更新的时候，Elasticsearch就会删除旧的文档，然后在索引一个新的文档
下面这个例子展示了如何更新一个文档（文档的ID为1），改变name字段为"John"，并且同时添加一个age字段
请求：
curl -X POST "localhost:9200/customer/_doc/1/_update?pretty" -H ‘Content-Type: application/json‘ -d‘ { "doc": { "name": "John", "age": 18 } } ‘
响应：
{ "_index" : "customer", "_type" : "_doc", "_id" : "1", "_version" : 3, "result" : "updated", "_shards" : { "total" : 2, "successful" : 1, "failed" : 0 }, "_seq_no" : 2, "_primary_term" : 2 }
下面在用一个例子用脚本将age增加5
请求：
curl -X POST "localhost:9200/customer/_doc/1/_update?pretty" -H ‘Content-Type: application/json‘ -d‘ { "script" : "ctx._source.age += 5" } ‘
在这面"ctx._source.age"表示的是引用当前源文档
删除文档其实相当简单。那就掩饰一下如何从customer索引中删除ID为2的文档
请求：
curl -X DELETE "localhost:9200/customer/_doc/2?pretty"
响应：
{ "_index" : "customer", "_type" : "_doc", "_id" : "2", "_version" : 1, "result" : "not_found", "_shards" : { "total" : 2, "successful" : 1, "failed" : 0 }, "_seq_no" : 4, "_primary_term" : 2 }
除了能够索引、更新、删除单个文档之外，Elasticsearch黑可以使用_bulk API批量执行上述的任何操作
这个功能其实非常重，因为它提供了一个非常有效的机制，可以在尽可能少的网络中往返的情况下尽可能快的执行多个操作
下面的例子同时索引两个文档
请求：
curl -X POST "localhost:9200/customer/_doc/_bulk?pretty" -H ‘Content-Type: application/json‘ -d‘ {"index":{"_id":"1"}} {"name": "John Doe" } {"index":{"_id":"2"}} {"name": "Jane Doe" } ‘
响应：
{ "took" : 17, "errors" : false, "items" : [ { "index" : { "_index" : "customer", "_type" : "_doc", "_id" : "1", "_version" : 5, "result" : "updated", "_shards" : { "total" : 2, "successful" : 1, "failed" : 0 }, "_seq_no" : 5, "_primary_term" : 2, "status" : 200 } }, { "index" : { "_index" : "customer", "_type" : "_doc", "_id" : "2", "_version" : 1, "result" : "created", "_shards" : { "total" : 2, "successful" : 1, "failed" : 0 }, "_seq_no" : 6, "_primary_term" : 2, "status" : 201 } } ] }
更新第一个文档，删除第二个文档
请求：
curl -X POST "localhost:9200/customer/_doc/_bulk?pretty" -H ‘Content-Type: application/json‘ -d‘ {"update":{"_id":"1"}} {"doc": { "name": "1213William" } } {"delete":{"_id":"2"}} ‘
响应：
{ "took" : 50, "errors" : false, "items" : [ { "update" : { "_index" : "customer", "_type" : "_doc", "_id" : "1", "_version" : 6, "result" : "updated", "_shards" : { "total" : 2, "successful" : 1, "failed" : 0 }, "_seq_no" : 7, "_primary_term" : 2, "status" : 200 } }, { "delete" : { "_index" : "customer", "_type" : "_doc", "_id" : "2", "_version" : 2, "result" : "deleted", "_shards" : { "total" : 2, "successful" : 1, "failed" : 0 }, "_seq_no" : 8, "_primary_term" : 2, "status" : 200 } } ] }
新建一个文件夹account.json，然后将数据复制粘贴到该文件中，保存并且退出在这个account.json文件夹所在目录下面执行如下命令：
curl -H "Content-Type: application/json" -XPOST "localhost:9200/bank/_doc/_bulk?
pretty&refresh" --data-binary "@accounts.json"
这个时候account.json中的文档数据就已经被索引到"bank"索引下
请求：
curl "localhost:9200/_cat/indices?v"
响应：
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size yellow open bank kfOzQHy7Rg-FGzS_MV-6zw 1 1 1000 0 414.2kb 414.2kb yellow open customer SXDtQcKHSyKMwC4PR2proA 1 1 1 1 13.4kb 13.4kb
在这里可以看到，现在我们的集群中有两个索引，分别是"bank", "customer"，这里面customer只有一个我们自己创建的文档，但是bank却有1000个
运行搜索有两种基本的方法：
一种是把检索参数放在URL后面，另一种是放在请求体的里面。 间接的可以看成是HTTP的GET和POST请求
请求体方法允许你更有表现力，也可以用更可读的JSON格式来定义搜索。用于搜索的REST API可以从_search端点访问。
下面的例子返回的是bank索引中的所有中文文档
curl -X GET "localhost:9200/bank/_search?q=*&sort=account_number:asc&pretty"
分析一下这个请求：
我们自bank索引中，q=*表示匹配所有的文档
sort=account_number：asc并表示每个文档的account_number字段升序排序；pretty参数表示返回漂亮打印的JSON结果
响应：
{ "took" : 6, "timed_out" : false, "_shards" : { "total" : 1, "successful" : 1, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "value" : 1000, "relation" : "eq" }, "max_score" : null, "hits" : [ { "_index" : "bank", "_type" : "_doc", "_id" : "0", "_score" : null, "_source" : { "account_number" : 0, "balance" : 16623, "firstname" : "Bradshaw", "lastname" : "Mckenzie", "age" : 29, "gender" : "F", "address" : "244 Columbus Place", "employer" : "Euron", "email" : "bradshawmckenzie@euron.com", "city" : "Hobucken", "state" : "CO" }, "sort" : [ 0 ] }, { "_index" : "bank", "_type" : "_doc", "_id" : "1", "_score" : null, "_source" : { "account_number" : 1, "balance" : 39225, "firstname" : "Amber", "lastname" : "Duke", "age" : 32, "gender" : "M", "address" : "880 Holmes Lane", "employer" : "Pyrami", "email" : "amberduke@pyrami.com", "city" : "Brogan", "state" : "IL" }, "sort" : [ 1 ] }, { "_index" : "bank", "_type" : "_doc", "_id" : "2", "_score" : null, "_source" : { "account_number" : 2, "balance" : 28838, "firstname" : "Roberta", "lastname" : "Bender", "age" : 22, "gender" : "F", "address" : "560 Kingsway Place", "employer" : "Chillium", "email" : "robertabender@chillium.com", "city" : "Bennett", "state" : "LA" }, "sort" : [ 2 ] }, { "_index" : "bank", "_type" : "_doc", "_id" : "3", "_score" : null, "_source" : { "account_number" : 3, "balance" : 44947, "firstname" : "Levine", "lastname" : "Burks", "age" : 26, "gender" : "F", "address" : "328 Wilson Avenue", "employer" : "Amtap", "email" : "levineburks@amtap.com", "city" : "Cochranville", "state" : "HI" }, "sort" : [ 3 ] }, { "_index" : "bank", "_type" : "_doc", "_id" : "4", "_score" : null, "_source" : { "account_number" : 4, "balance" : 27658, "firstname" : "Rodriquez", "lastname" : "Flores", "age" : 31, "gender" : "F", "address" : "986 Wyckoff Avenue", "employer" : "Tourmania", "email" : "rodriquezflores@tourmania.com", "city" : "Eastvale", "state" : "HI" }, "sort" : [ 4 ] }, { "_index" : "bank", "_type" : "_doc", "_id" : "5", "_score" : null, "_source" : { "account_number" : 5, "balance" : 29342, "firstname" : "Leola", "lastname" : "Stewart", "age" : 30, "gender" : "F", "address" : "311 Elm Place", "employer" : "Diginetic", "email" : "leolastewart@diginetic.com", "city" : "Fairview", "state" : "NJ" }, "sort" : [ 5 ] }, { "_index" : "bank", "_type" : "_doc", "_id" : "6", "_score" : null, "_source" : { "account_number" : 6, "balance" : 5686, "firstname" : "Hattie", "lastname" : "Bond", "age" : 36, "gender" : "M", "address" : "671 Bristol Street", "employer" : "Netagy", "email" : "hattiebond@netagy.com", "city" : "Dante", "state" : "TN" }, "sort" : [ 6 ] }, { "_index" : "bank", "_type" : "_doc", "_id" : "7", "_score" : null, "_source" : { "account_number" : 7, "balance" : 39121, "firstname" : "Levy", "lastname" : "Richard", "age" : 22, "gender" : "M", "address" : "820 Logan Street", "employer" : "Teraprene", "email" : "levyrichard@teraprene.com", "city" : "Shrewsbury", "state" : "MO" }, "sort" : [ 7 ] }, { "_index" : "bank", "_type" : "_doc", "_id" : "8", "_score" : null, "_source" : { "account_number" : 8, "balance" : 48868, "firstname" : "Jan", "lastname" : "Burns", "age" : 35, "gender" : "M", "address" : "699 Visitation Place", "employer" : "Glasstep", "email" : "janburns@glasstep.com", "city" : "Wakulla", "state" : "AZ" }, "sort" : [ 8 ] }, { "_index" : "bank", "_type" : "_doc", "_id" : "9", "_score" : null, "_source" : { "account_number" : 9, "balance" : 24776, "firstname" : "Opal", "lastname" : "Meadows", "age" : 39, "gender" : "M", "address" : "963 Neptune Avenue", "employer" : "Cedward", "email" : "opalmeadows@cedward.com", "city" : "Olney", "state" : "OH" }, "sort" : [ 9 ] } ] } }
可以看到：
下面一个是和上面一个相同，但是用请求体的例子：
curl -X GET "localhost:9200/bank/_search" -H ‘Content-Type: application/json‘ -d‘ { "query": { "match_all": {} }, "sort": [ { "account_number": "asc" } ] } ‘
区别：
我们没有在URL中传q=*，而是向_search API提供json风格的查询请求体
很重要的一点就是，一旦返回搜索结果，Elasticsearch就完全完成了对请求的处理，不会在结果中维护任何类型的服务器资源或打开游标
Elasticsearch提供了一种json风格的语言，你可以使用这种语言执行查询。这被成为查询DSL
查询语言非常全面，乍一看可能会很吓人，但是实际上最好的学习方法就是从几个基本的实例开始学习
我们执行这样的查询：
curl -X GET "localhost:9200/bank/_search" -H ‘Content-Type: application/json‘ -d‘ { "query": { "match_all": {} } } ‘
查询部分告诉我们查询定义是什么，match_all部分只是我们想要运行的查询类型。这里match_all查询只是在指定索引中搜索所有文档
除了查询参数之外，我们还可以传递其他参数来影响搜索的结果。在上面部分的例子中，我们传的是sort参数，但是在这里我们传的是size：
curl -X GET "localhost:9200/bank/_search" -H ‘Content-Type: application/json‘ -d‘ { "query": { "match_all": {} }, "size": 1 } ‘
elasticsearch_mac
原文：https://www.cnblogs.com/tulintao/p/11579926.html