ElasticSearch的API, DSL查询语句

#增加数据: 
POST users/_doc
{
  "name":"redis",
  "age":29,
  "sex": "男"
}
#带主键， 如果主键不存在，则插入；反之，则更新
POST users/_doc/1
{
  "name": "李宇鸿",
  "age": 20,
  "sex": "男"
}

#更新操作: 
POST users/_doc/1
{
  "name": "John Doe2"
}
POST users/_update/1
{
  "doc": {
    "name": "lyh22"
  }
}
PUT users/_doc/1
{
  "name": "Liyuhong"
}

#更新的同时增加属性: 
POST users/_update/1
{
  "doc": {
    "name": "Jane Doe",
    "city": "合肥",
    "age": 20
  }
}

#批量操作: 
POST users/_doc/_bulk
{"index":{"_id":"1"}}
{"name":"John Doe"}
{"index":{"_id":"2"}}
{"name":"Jane Doe"}

#查询DSL: 
GET bank/_search
{
  "query": {
    "match_all": {}
  },
  "from": 0, 
  "size": 3, 
  "sort": [
    {
      "account_number": {
        "order": "asc"
      }
    }
  ]
}

#返回部分字段: 
GET bank/_search
{
  "query": {
    "match_all": {}
  },
  "_source": ["age", "balance", "firstname"]
}

#match精确匹配查询
GET bank/_search
{
  "query": {
    "match": {
      "account_number": "20"
    }
  }
}

#字符串, 全文检索: 
GET bank/_search
{
  "query": {
    "match": {
      "address": "mill"
    }
  }
}

#字符串，多个单词(分词+全文检索):
GET bank/_search
{
  "query": {
    "match": {
      "address": "mill road"
    }
  }
}

#将需要匹配的值当成一个整体单词（不分词）进行检索
GET bank/_search
{
  "query": {
    "match_phrase": {
      "address": "mill road"
    }
  }
}

#multi_match【多字段匹配】state或者address包含mill
GET bank/_search
{
  "query": {
    "multi_match": {
      "query": "625",
      "fields": [
        "account_number", 
        "address"
      ]
    }
  }
}

#multi_match【多字段匹配】state或者address包含mill
GET bank/_search
{
  "query": {
    "multi_match": {
      "query": "625",
      "fields": [
        "account_number", 
        "address"
      ]
    }
  }
}

#bool复合查询: 查出address是 MILL且是男性的
GET bank/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "address": "MILL"
          }
        },
        {
          "match": {
            "gender": "M"
          }
        }
      ]
    }
  }
}

#should：应该达到should列举的条件，如果达到会增加相关文档的评分，并不会改变 查询的结果
GET bank/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "address": "MILL"
          }
        },
        {
          "match": {
            "gender": "M"
          }
        }
      ],
      "should": [
        {
          "match": {
            "address": "lane"
          }
        }
      ]
    }
  }
}

#filter【结果过滤】:过滤出balance在18000~20000之间
GET bank/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "address": "Street"
          }
        }
      ],
      "filter": {
        "range": {
          "balance": {
            "gte": 18000,
            "lte": 20000
          }
        }
      }
    }
  },
  "from": 0,
  "size": 50
}

#全文检索字段用 match，其他非 text 字段匹配用 term
GET bank/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "age": {
              "value": "28"
            }
          }
        },
        {
          "match": {
            "address": "990"
          }
        }
      ]
    }
  }
}

aggregations(聚合) 最简单的聚合方法大致等于SQL GROUP BY 和 SQL 聚合函数

#先查出address中包含mill的, 在聚合分析出年龄分布,
#以及年龄的平均值, size:0表示只显示聚合结果
#ageAgg表示这次聚合的名字, terms是聚合的类型
GET bank/_search
{
  "query": {
    "match": {
      "address": "mill"
    }
  },
  "aggs": {
    "ageAgg": {
      "terms": {
        "field": "age",
        "size": 10
      }
    },
    "avg_agg": {
      "avg": {
        "field": "age"
      }
    }
  },
  "size": 0
}

#先按照年龄聚合, 再计算每个年龄段的人的平均薪资
GET bank/_search
{
  "query": {
    "match_all": {}
  },
  "aggs": {
    "ageAgg": {
      "terms": {
        "field": "age",
        "size": 1000,
        "order": {
          "_key": "asc"
        }
      },
      "aggs": {
        "balanceAgg": {
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  }
}

#查出所有年龄分布，以及这些年龄段中男性的平均薪资
#和女性的平均薪资以及这个年龄 段的总体平均薪资
GET bank/_search
{
  "query": {
    "match_all": {}
  },
  "aggs": {
    "ageAgg": {
      "terms": {
        "field": "age",
        "size": 100,
        "order": {
          "_key": "asc"
        }
      },
      "aggs": {
        "genderAgg": {
          "terms": {
            "field": "gender.keyword",
            "size": 100
          },
          "aggs": {
            "balanceAvg": {
              "avg": {
                "field": "balance"
              }
            }
          }
        },
        "balanceAvg": {
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  }
}

Mapping 是用来定义一个文档（document），以及它所#包含的属性（field）是如何存储和 索引的

GET my_index/_mapping
#创建索引并指定映射
PUT my_index
{
  "mappings": {
    "properties": {
      "age": {
        "type": "integer"
      },
      "email": {
        "type": "keyword"
      },
      "name": {
        "type": "text"
      }
    }
  }
}
#添加新的字段映射
PUT my_index/_mapping
{
  "properties": {
    "employee-id": {
      "type": "keyword",
      "index": false
    }
  }
}

更新映射(对于已经存在的映射字段，我们不能更新。更新必须创建新的索引进行数据迁移)

#source源索引数据, dest目标索引
POST _reindex
{
  "source": {
    "index": "users"
  },
  "dest": {
    "index": "userman"
  }
}
GET userman/_search
POST _reindex
{
  "source": {
    "index": "users",
    "type": "_doc"
  },
  "dest": {
    "index": "user_woman"
  }
}
GET user_woman/_search