elasticsearch常用语句，kibana查询语法，爬坑中

怼烎@ 2022-03-18 15:29 363阅读 0赞

在上文[centos7安装elk之，安装logstash-6.6.0，同步mysql数据，详细安装步骤][centos7_elk_logstash-6.6.0_mysql]中，我安装了，logstash-6.6.0，并成功同步了mysql中的数据。

有了数据，接下来就是玩转数据，作为一个新手，各种语句我全都不懂，于是搜着查询方法在kibana中查询同步的mysql中的数据。

如图：

get /details/_search?_source=id,title,readsum
    {
      "query":{
        "match_all": {}
      }
    }

我想用这个语句查询出这个索引下的所有数据。（老手不要笑我哦！）

结果看到右侧，这里显示是137条记录，但滚动条却说了实话，明显没有这么多条嘛

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3MzE2Mjcy_size_16_color_FFFFFF_t_70][]

于是还怀疑是不是logstash同步数据不对。

于是我数了一下，输出的数据正好10条，那我就觉得肯定有地方可以做限制，他默认就是输出10条。

百度了一下，想要多少条得在查询中制定size，真尴尬

我更改查询语句

get /details/_search?_source=id,title,readsum
    {
      "query":{
        "match_all": {}
      },
      "size":100
    }

这样就可以了

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3MzE2Mjcy_size_16_color_FFFFFF_t_70 1][]

为了方便以后操作elasticsearch方便，我把一些常用的语句记录在这里

#添加索引
    put /lib
    {
      "settings":{
        "index":{
          "number_of_shards":5,
          "number_of_replicas":1
        }
      }
    }
    #可以简写成
    put /lib

#查询所有数据
    GET _search
    {
      "query": {
        "match_all": {}
      }
    }

#查看索引设置
    get /xinxiera/_settings

#查看所有索引的配置
    get /_all/_settings

#添加文档，指定id
    put /lib/user/1
    {
      "name":"张三",
      "age":18,
      "hobbit":"打球"
    }
    添加文档，不指定id
    post /lib/user
    {
      "name":"李四",
      "age":16,
      "hobbit":"睡觉"
    }

#修改文档
    post /lib/user/1/_update
    {
      "doc":{
        "age":19
      }
    }

#删除索引
    delete /lib

#删除文档
    delete /lib/user/(id)

#查看索引的mapping
    get /xinxiera/_mappings

#查询索引下的文档，指定查看的字段和需要的数据量(注意size)
    get /xinxiera/details/_search?_source=id,title
    {
      "query":{
        "match_all": {}
      },
      "size":500
    }
    #在浏览器中可以简写成
    /xinxiera/_search?_source=id,title,readsum&size=500

> multi get 批量获取文档

get /_mget
    {
      "docs":[
        {
          "_index":"lib",
          "_type":"user",
          "_id":1
        },
        {
          "_index":"lib",
          "_type":"user",
          "_id":2
        },
        {
          "_index":"lib",
          "_type":"user",
          "_id":3
        }
      ]
    }
    #简化，并且指定字段
    get /lib/user/_mget
    {
      "docs":[
        {
          "_id":1,
          "_source":["name","age"]
        },
        {
          "_id":2
        },
        {
          "_id":3
        }
      ]
    }
    #在简化
    get /lib/user/_mget
    {
        "ids":[1,2,3]
    }

>  bulk实现批量操作

#批量添加
    post /lib2/books/_bulk
    {"index":{"_id":1}}
    {"title":"java","price":55}
    {"index":{"_id":2}}
    {"title":"Html5","price":45}
    {"index":{"_id":3}}
    {"title":"php","price":55}

#批量操作（增删改）
    post /lib2/books/_bulk
    {"delete":{"_index":"lib2","_type":"books","_id":4}}
    {"create":{"_index":"tt","_type":"ttt","_id":"100"}}
    {"name":"lisi"}
    {"index":{"_index":"tt","_type":"ttt"}}
    {"name":"zhaosi"}
    {"update":{"_index":"lib2","_type":"books","_id":4}}
    {"doc":{"price":58}}

> 手动创建mapping

#手动创建mapping
    put /lib6
    {
      "settings":{
        "number_of_shards":3,
        "number_of_replicas":0
      },
      "mappings":{
        "books":{
          "properties":{
            "title":{"type":"text"},
            "name":{"type":"text","analyzer":"standard"},
            "publish_date":{"type":"date","index":false},
            "price":{"type":"double"},
            "number":{"type":"integer"}
          }
        }
      }
    }

>  搜索数据

#查找name是lisi的
    get /lib3/user/_search?q=name:lisi

获取名字是zhaoliu的(完全匹配)
    get /lib3/user/_search
    {
      "query":{
        "term": {"name":"zhaoliu"}
      }
    }

#获取兴趣中含有唱歌的，并按照年龄降序排序
    get /lib3/user/_search?q=interests:changge&sort=age:desc

term忽略分词器查找
    #只要含有一个关键词则会被匹配
    get /lib3/user/_search
    {
      "query":{
        "terms": {
          "interests": ["hejiu","changge"]
        }
      }
    }
    #from从哪开始,size取几个
    get /lib3/user/_search
    {
      "from":0,
      "size":2,
      "query":{
        "terms": {
          "interests": ["hejiu","changge"]
        }
      }
    }
    #查看版本号
    get /lib3/user/_search
    {
      "version":true,
      "from":0,
      "size":2,
      "query":{
        "terms": {
          "interests": ["hejiu","changge"]
        }
      }
    }

#match 分词查找
    get /lib3/user/_search
    {
      "query":{
        "match": {
          "name": "zhaoliu zhaoming"
        }
      }
    }

#multi_match指定多个字段查找
    get /lib3/user/_search
    {
      "query":{
        "multi_match": {
          "query": "changge",
          "fields": ["interests","name"]
        }
      }
    }

#短语匹配，匹配含有此短语的
    get /lib3/user/_search
    {
      "query":{
        "match_phrase": {
          "interests":"duanlian,changge"
        }
      }
    }
    #控制返回的字段(可以使用通配符)
    get /lib3/user/_search
    {
      "_source":["address","name"],
      "query":{
        "match_phrase": {
          "interests":"duanlian,changge"
        }
      }
    }
    #包含什么字段，排除什么字段
    get /lib3/user/_search
    {
      "_source":{
        "includes":["name"],
        "excludes":["age"]
      },
      "query":{
        "match_phrase": {
          "interests":"duanlian,changge"
        }
      }
    }
    #按年龄升序
    get /lib3/user/_search
    {
      "_source":{
        "includes":["name"],
        "excludes":["age"]
      },
      "query":{
        "match_phrase": {
          "interests":"duanlian,changge"
        }
      },
      "sort":[{
        "age":{
          "order":"asc"
        }
      }]
    }
    #前缀匹配
    get /lib3/user/_search
    {
      "query":{
        "match_phrase_prefix": {
          "name": {
            "query":"zhao"
          }
        }
      }
    }

#范围匹配
    get /lib3/user/_search
    {
      "query":{
        "range":{
          "birthday": {
            "from": "1990-10-10",
            "to": "2018-05-01"
          }
        }
      }
    }
    #from包含，to不包含
    get /lib3/user/_search
    {
      "query":{
        "range":{
          "birthday": {
            "from": "1990-10-10",
            "to": "2018-05-01",
            "include_lower":true,
            "include_upper":false
          }
        }
      }
    }

#通配符查询
    get /lib3/user/_search
    {
      "query":{
        "wildcard": {
          "name":"zhao*"
        }
      }
    }
    get /lib3/user/_search
    {
      "query":{
        "wildcard": {
          "name":"li?i"
        }
      }
    }

#模糊查询
    get /lib3/user/_search
    {
      "query":{
        "fuzzy": {
          "name": "zholiu"
        }
      }
    }

#搜索内容高亮显示
    get /lib3/user/_search
    {
      "query":{
        "match": {
          "interests": "changge"
        }
      },
      "highlight":{
        "fields":{
          "interests":{}
        }
      }
    }

> 中文分词相关

前提是需要在elasticsearch中安装中文分词器，觉得有必要的朋友可以评论一下，然后我在加上文章

#创建索引，配置mapping，注意选择中文分词器
    put /lib4
    {
      "settings":{
        "number_of_shards":3,
        "number_of_replicas":0
      },
      "mappings":{
        "user":{
          "properties":{
            "name":{"type":"text","analyzer":"ik_max_word"},
            "address":{"type":"text","analyzer":"ik_max_word"},
            "age":{"type":"integer"},
            "interests":{"type":"text","analyzer":"ik_max_word"},
            "birthday":{"type":"date"}
          }
        }
      }
    }

其他的都和上面英文的一样了,暂且写这些吧，聚合查询，符合查询，等用上了在总结

[centos7_elk_logstash-6.6.0_mysql]: https://blog.csdn.net/qq_37316272/article/details/87783345
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3MzE2Mjcy_size_16_color_FFFFFF_t_70]: /images/20220318/a9121027ba02426e8175eb56c8e49a38.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3MzE2Mjcy_size_16_color_FFFFFF_t_70 1]: /images/20220318/53fecd5955534f01b3da67b7d44d39f0.png