簡述ES（ElasticSearch入門簡介）
根據ES的官方文件，可以簡單定義以下3點：
1 .一個分散式的實施文件儲存，每個欄位可以被索引與搜尋
2 .一個分散式實時分析搜尋引擎
3 .可以勝任上百個服務節點的擴充套件，並支援PB級別的結構化或者非結構化資料。
Elasticsearch請求和HTTP請求類似，由以下幾個相同的部件構成
curl -X<VERB>'<PROTOCOL>://<HOST>:<PORT>/<PATH>?<QUERY_STRING>'-d '<BODY>'
|
VERB |
適當的 HTTP 方法 或 謂詞 : GET`、 `POST`、 `PUT`、 `HEAD 或者 `DELETE`。 |
|
PROTOCOL |
http 或者 https`（如果你在 Elasticsearch 前面有一個 `https 代理） |
|
HOST |
Elasticsearch 叢集中任意節點的主機名，或者用 localhost 代表本地機器上的節點。 |
|
PORT |
執行 Elasticsearch HTTP 服務的埠號，預設是 9200 。 |
|
PATH |
API 的終端路徑（例如 _count 將返回叢集中文件數量）。Path 可能包含多個元件，例如：_cluster/stats 和 _nodes/stats/jvm 。 |
|
QUERY_STRING |
任意可選的查詢字串引數 (例如 ?pretty 將格式化地輸出 JSON 返回值，使其更容易閱讀) |
|
BODY |
一個 JSON 格式的請求體 (如果請求需要的話) |
ES Restful API GET、POST、PUT、DELETE、HEAD含義：
1）GET：獲取請求物件的當前狀態。
2）POST：改變物件的當前狀態。
3）PUT：建立一個物件。
4）DELETE：銷燬物件。
5）HEAD：請求獲取物件的基礎資訊。
Mysql與Elasticsearch核心概念對比示意圖
以上表為依據，
ES中的新建文件（在Index/type下）相當於Mysql中（在某Database的Table）下插入一行資料。
1、新建文件（類似mysql insert插入操作）
http://localhost:9200/blog/ariticle/1 put
{
"title":"New version of Elasticsearch released!",
"content":"Version 1.0 released today!",
"tags":["announce","elasticsearch","release"]
}建立成功如下顯示：
{
- "_index": "blog",
- "_type": "ariticle",
- "_id": "1 -d",
- "_version": 1,
- "_shards": {
- "total": 2,
- "successful": 1,
- "failed": 0
- },
- "created": true
}
2、檢索文件（類似mysql search 搜尋select*操作）
檢索結果如下：
{
- "_index": "blog",
- "_type": "ariticle",
- "_id": "1",
- "_version": 1,
- "found": true,
- "_source": {
- "title": "New version of Elasticsearch released!",
- "content": "Version 1.0 released today!",
- "tags": [
- "announce"
- ,
- "elasticsearch"
- ,
- "release"
- ]
- }
}如果未找到會提示：
{
- "_index": "blog",
- "_type": "ariticle",
- "_id": "11",
- "found": false
}查詢全部文件如下： 
具體某個細節內容檢索，
查詢舉例1：查詢cotent列包含版本為1.0的資訊。
http://localhost:9200/blog/
_search?pretty&q=content:1.0
{
- "took": 2,
- "timed_out": false,
- "_shards": {
- "total": 5,
- "successful": 5,
- "failed": 0
- },
- "hits": {
- "total": 1,
- "max_score": 0.8784157,
- "hits": [
- {
- "_index": "blog",
- "_type": "ariticle",
- "_id": "6",
- "_score": 0.8784157,
- "_source": {
- "title": "deep Elasticsearch!",
- "content": "Version 1.0!",
- "tags": [
- "deep"
- ,
- "elasticsearch"
- ]
- }
- }
- ]
- }
}查詢舉例2：查詢書名title中包含“enhance”欄位的資料資訊：
[[email protected] ~]# curl -XGET 10.200.1.121:9200/blog/ariticle/_search?pretty -d ‘
> { "query" : {
> "term" :
> {"title" : "enhance" }
> }
> }'
{
"took" : 189,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 2,
"max_score" : 0.8784157,
"hits" : [ {
"_index" : "blog",
"_type" : "ariticle",
"_id" : "4",
"_score" : 0.8784157,
"_source" : {
"title" : "enhance Elasticsearch!",
"content" : "Version 4.0!",
"tags" : [ "enhance", "elasticsearch" ]
}
}, {
"_index" : "blog",
"_type" : "ariticle",
"_id" : "5",
"_score" : 0.15342641,
"_source" : {
"title" : "enhance Elasticsearch for university!",
"content" : "Version 5.0!",
"tags" : [ "enhance", "elasticsearch" ]
}
} ]
}
}查詢舉例3：查詢ID值為3,5,7的資料資訊：
[[email protected] ~]# curl -XGET 10.200.1.121:9200/blog/ariticle/_search?pretty -d ‘
{ "query" : {
"terms" :
{"_id" : [ "3", "5", "7" ] }
}
}'
{
"took" : 5,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 3,
"max_score" : 0.19245009,
"hits" : [ {
"_index" : "blog",
"_type" : "ariticle",
"_id" : "5",
"_score" : 0.19245009,
"_source" : {
"title" : "enhance Elasticsearch for university!",
"content" : "Version 5.0!",
"tags" : [ "enhance", "elasticsearch" ]
}
}, {
"_index" : "blog",
"_type" : "ariticle",
"_id" : "7",
"_score" : 0.19245009,
"_source" : {
"title" : "deep Elasticsearch for university!",
"content" : "Version 2.0!",
"tags" : [ "deep", "elasticsearch", "university" ]
}
}, {
"_index" : "blog",
"_type" : "ariticle",
"_id" : "3",
"_score" : 0.19245009,
"_source" : {
"title" : "init Elasticsearch for university!",
"content" : "Version 3.0!",
"tags" : [ "initialize", "elasticsearch" ]
}
} ]
}
}3、更新文件（類似mysql update操作）
更新後結果顯示：
{
- “_index”: “blog”,
- “_type”: “ariticle”,
- “_id”: “1”,
- “_version”: 2,
- “_shards”: {
- ”total”: 2,
- “successful”: 1,
- “failed”: 0
- }
}
{
- "_index": "blog",
- "_type": "ariticle",
- "_id": "1",
- "_version": 2,
- "found": true,
- "_source": {
- "title": "New version of Elasticsearch released!",
- "content": "new version 2.0 20160714",
- "tags": [
- "announce"
- ,
- "elasticsearch"
- ,
- "release"
- ]
- }
}
```
注意更新文件需要在elasticsearch_win\config\elasticsearch.yml下新增以下內容：
script.groovy.sandbox.enabled: true
script.engine.groovy.inline.search: on
script.engine.groovy.inline.update: on
script.inline: on
script.indexed: on
script.engine.groovy.inline.aggs: on
index.mapper.dynamic: true
4、刪除文件（類似mysql delete操作）
{
- "found": true,
- "_index": "blog",
- "_type": "ariticle",
- "_id": "8",
- "_version": 2,
- "_shards": {
- "total": 2,
- "successful": 1,
- "failed": 0
- }
}
5、Kibana視覺化分析
5.1、在索引blog上查詢包含”university”欄位的資訊。
5.2、Kibana多維度分析
——————————————————————————————————
.