elasticsearch 使用指南-白红宇

文档：

安装中文分析器

// 下载elasticsearchwget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.2.4.zip./bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v6.2.4/elasticsearch-analysis-ik-6.2.4.zip// 访问不了github 可以先下载到本地，在安装./bin/elasticsearch-plugin install file:///mnt/elasticsearch-6.2.4/elasticsearch-analysis-ik-6.2.4.zip复制代码

配置

ulimit 设置为大于65536设置文件 /etc/sysctr.conf 参数vm.max_map_count=655360远程访问修改文件 ./elasticsearch-6.2.4/config/elasticsearch.ymlnetwork.host: 0.0.0.0   // 设置过此项，会认为切换到生产环境，会检测系统文件最大打开数量是否达标，否则启动失败启动参数设置ES_HEAP_SIZE参数export ES_HEAP_SIZE=10g此外，你也可以通过命令行参数的形式，在程序启动的时候把内存大小传递给它，如果你觉得这样更简单的话：./bin/elasticsearch -Xmx10g -Xms10g 确保堆内存最小值（ Xms ）与最大值（ Xmx ）的大小是相同的，防止程序在运行时改变堆内存大小， 这是一个很耗系统资源的过程。通常来说，设置 ES_HEAP_SIZE 环境变量，比直接写 -Xmx -Xms 更好一点。复制代码

守护进程启动

./bin/elasticsearch -d  // -d参数守护进程启动复制代码

停止

$ ./bin/elasticsearch -p /tmp/elasticsearch-pid -d$ cat /tmp/elasticsearch-pid && echo15516$ kill -SIGTERM 15516复制代码

索引(库)

// 创建索引(库)curl -XPUT 'localhost:9200/lovewith_v1?pretty'// 查看索引curl -X GET "localhost:9200/lovewith"// 删除索引curl -X DELETE "localhost:9200/lovewith_v2"复制代码

创建索引别名

// 设置单个别名curl -X PUT "localhost:9200/lovewith_v1/_alias/lovewith"// https://www.elastic.co/guide/en/elasticsearch/reference/6.2/indices-aliases.htmlcurl -X POST "localhost:9200/_aliases" -H 'Content-Type: application/json' -d' { "actions" : [         { "add" : { "index" : "lovewith_v2", "alias" : "lovewith" } },        { "remove" : { "index" : "lovewith_v1", "alias" : "lovewith" } }    ]}'// 查看索引别名curl -X GET "localhost:9200/_alias/lovewith*"// 删除别名curl -X DELETE "localhost:9200/lovewith_v1/_alias/lovewith"复制代码

创建 type（表）

curl -X PUT "localhost:9200/lovewith/_mapping/${type名}" -H 'Content-Type: application/json' -d'{    "fulltext": {          "_all": {          "analyzer": "ik"      },    "properties": {    "id": {      "type": "integer"    },    "tag": {      "type": "text"    //text取代了string，当一个字段是要被全文搜索的，比如Email内容、产品描述，应该使用text类型。设置text类型以后，字段内容会被分析，在生成倒排索引以前，字符串会被分析器分成一个一个词项。text类型的字段不用于排序，很少用于聚合（termsAggregation除外）      "analyzer": "ik_max_word",    // not_analyzed 不分词    "search_analyzer": "ik_max_word"    },    "color": {        "type":"keyword", //keyword类型的数据只能完全匹配，适合那些不需要分词的数据，比如email地址、主机名、状态码和标签。如果字段需要进行过滤(比如查找已发布博客中status属性为published的文章)、排序、聚合。keyword类型的字段只能通过精确值搜索到。    }    "created_at": {      "type": "date",      "format": "EEE MMM dd HH:mm:ss Z YYYY"    }  }}'// 查看 typecurl -X GET "localhost:9200/lovewith_v1/_mapping/${type名}"// 检测 type 是否存在curl -X HEAD "localhost:9200/lovewith_v1/_mapping/${type名}"复制代码

mapping

// 查看索引mappingcurl -XGET "http://localhost:9200/lovewith/_mapping?pretty"curl -X GET "localhost:9200/_all/_mapping"curl -X GET "localhost:9200/_mapping"// 查看具体字段mappingcurl -X GET "localhost:9200/lovewith/_mapping/${type名}/field/title"// 修改mappingcurl -X PUT "localhost:9200/lovewith/_mapping/${type名}" -H 'Content-Type: application/json' -d'{    "properties": {        "color": {            "type": "keyword",            "index": true        }    }}'复制代码

分词测试

// 标准模式curl -X POST "localhost:9200/_analyze" -H 'Content-Type: application/json' -d'{  "analyzer": "standard",   // ik_max_word 中文分词模式  "text": "The 2 QUICK Brown-Foxes jumped over the lazy dog\u0027s bone."}'复制代码

bulk 批处理

// 方式一 httpcurl -X POST "localhost:9200/_bulk" -H 'Content-Type: application/json' -d'{ "index" : { "_index" : "lovewith_v1", "_type" : "${type名}", "_id" : "1" } }{ "field1" : "value1" }{ "delete" : { "_index" : "lovewith_v1", "_type" : "${type名}", "_id" : "2" } }{ "create" : { "_index" : "lovewith_v1", "_type" : "${type名}", "_id" : "3" } }{ "field1" : "value3" }{ "update" : {"_id" : "1", "_type" : "${type名}", "_index" : "lovewith_v1"} }{ "doc" : {"field2" : "value2"} }'// 方式二 读文件，大小控制在５～15M新建一个requests 文件，文件内容如下，最后一行以换行符结束，"_id" 可不填，es 会自动生成cat requests{ "index" : { "_index" : "test", "_type" : "_doc", "_id" : "1" } }{ "field1" : "value1" }// 执行如下命令curl -s -H "Content-Type: application/x-ndjson" -XPOST localhost:9200/_bulk --data-binary "@requests"; echo复制代码

统计

// 磁盘占比curl -X GET "localhost:9200/_cat/allocation?v"// 查看别名http://127.0.0.1:9200/_cat/aliases?v// 文档总数http://127.0.0.1:9200/_cat/count?v// 统计指定索引文档总数http://127.0.0.1:9200/_cat/count/lovewith?v复制代码

搜索

// 指定字段搜索http://127.0.0.1:9200/lovewith/album/_search?q=tag:花瓶聚合查询参考：http://www.cnblogs.com/huanxiyun/articles/5888874.html文档：https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations.html// 按数组字段精确过滤curl -X GET "localhost:9200/lovewith/album/_search?pretty" -H 'Content-Type: application/json' -d'{    "query": {        "match_phrase": {            "color1": 7        }    }}'// 过滤搜索 针对ketword类型字段有效curl -X GET "localhost:9200/lovewith/_search" -H 'Content-Type: application/json' -d'{  "query": {    "bool": {      "filter": [        { "term": { "color": "red"   }},        { "term": { "brand": "gucci" }}      ]    }  }}// 文档分页获取curl -XGET "http://localhost:9200/fqhelp_v1/_search?pretty&from=20&size=10"'## match 与term 区别https://www.cnblogs.com/yjf512/p/4897294.htmlANALYZED字段无法使用term，只能使用match_phrase// 搜索过滤curl -X GET "localhost:9200/lovewith/superlib/_search?pretty" -H 'Content-Type: application/json' -d'{  "query": {      "match":{        "tags":"婚纱"      }  },  "post_filter":{     "term": { "status": 1}  }}'复制代码

排序

// 默认只对数字，日期字段类型有效// https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-sort.htmlcurl -X GET "localhost:9200/my_index/_search" -H 'Content-Type: application/json' -d'{    "sort" : [        {"date": "asc"},        {"id": "desc"}    ],    "query" : {        "term" : { "user" : "kimchy" }    }}'复制代码

删除文档

curl -X DELETE "localhost:9200/lovewith/${type名}/${文档id}"复制代码

更单个文档

curl -X PUT "localhost:9200/lovewith/${type名}/1" -H 'Content-Type: application/json' -d'{    "counter" : 1,    "tags" : ["red"]}'复制代码

添加数字段

curl -X POST "localhost:9200/lovewith/album/WGj9s2MBsz6suBcoSKEi/_update?pretty" -H 'Content-Type: application/json' -d'{    "script" : "ctx._source.color1 = [7]"}'复制代码

更指定字段

// doc_as_upsert 为true 文档不存在时创建curl -X POST "localhost:9200/lovewith_v2/superlib/1998/_update?pretty" -H 'Content-Type: application/json' -d'{    "doc" : {        "id": 1998,        "path": "share/2012/12/15/14ad5c4a5156d21af088676dd2373b978rrJPB_650x999.jpg",        "tag": "婚纱照2"    },    "doc_as_upsert" : true}'复制代码

删除文档中的一个字段

// 删除 color字段curl -X POST "localhost:9200/lovewith/album/Vmjhs2MBsz6suBco4KFk/_update?pretty" -H 'Content-Type: application/json' -d'{    "script" : "ctx._source.remove(\u0027color\u0027)"}'复制代码

数组字段追加元素

curl -X POST "localhost:9200/lovewith/album/Vmjhs2MBsz6suBco4KFk/_update?pretty" -H 'Content-Type: application/json' -d'{    "script" : {        "source": "ctx._source.color1.add(params.color1)",        "lang": "painless",        "params" : {            "color1" : 7        }    }}'复制代码

删除type所有数

curl -X POST "localhost:9200/lovewith/album/_delete_by_query?conflicts=proceed" -H 'Content-Type: application/json' -d'{  "query": {    "match_all": {}  }}'复制代码

备份与恢复

如果是集群需要创建如下共享目录

安装 sshfs

sshfs 使用参考：

apt-get install fuse sshfsmkdir /mnt/backupchmod 755 /mnt/backupmkdir /data/es_backup# 每个节点挂载同样操作挂载/mnt/backupsshfs 192.168.1.10:/data/es_backup /mnt/backup -o allow_other其中的参数-o allow_other允许了其他用户访问这个目录。测试运行ES的用户对共享目录是否有写权限sudo -u elasticsearch touch /mnt/backup/test复制代码

在elasticsearch.yml中加入一行:

// 设置备份目录path.repo: ["/mnt/backup"]复制代码

// 创建仓库curl -XPUT 'http://127.0.0.1:9200/_snapshot/my_backup?pretty' -H 'Content-Type: application/json' -d '{"type": "fs","settings": {        "location":"/mnt/backup",        "max_snapshot_bytes_per_sec" : "50mb",         "max_restore_bytes_per_sec" :"50mb"    }}'// 刷新数据到磁盘curl -X POST "localhost:9200/lovewith/_flush"// 备份指定索引curl -XPUT 'http://127.0.0.1:9200/_snapshot/my_backup/snapshot_1' -H 'Content-Type: application/json' -d '{    "indices": "lovewith_v1"}?wait_for_completion=true'// 删除索引curl -XDELETE "http://192.168.1.10:9200/lovewith_v1"// 恢复指定索引将 /mnt/backup 下的所有文件传到目标节点仓库目录里curl -XPOST 'http://127.0.0.1:9200/_snapshot/my_backup/snapshot_1/_restore' -H 'Content-Type: application/json' -d '{    "indices": "lovewith_v2"}?wait_for_completion=true'// 查看恢复状curl -XGET 'http://127.0.0.1:9200/_snapshot/my_backup/snapshot_1/_status?pretty'// 删除快照curl -XDELETE 'http://127.0.0.1:9200/_snapshot/my_backup/snapshot_1'复制代码

translog

执行时es服务需要停bin/elasticsearch-translog truncate -d /var/lib/elasticsearchdata/nodes/0/indices/P45vf_YQRhqjfwLMUvSqDw/0/translog/复制代码