Elasticsearch入門篇——基礎知識

阿新 • • 發佈：2019-03-12

開發十年，就只剩下這套架構體系了！ >>>

還記得大二的時候，初入Java大門，就大言不慚的給老師說，我要開發一個搜尋引擎，結果是各種學習，各種找資料，終於在期末的時候，做出了一個簡單新聞搜尋頁面，搜尋模組是使用了Lucene。

今天，我們一起走進Elasticsearch的殿堂。

Elastic

以Elastic之名進行交易的資料搜尋軟體初創公司Elastic search於2018年10月5日（美國時間）上市。

Elastic 上市

Elastic Search 只是 Elastic 公司最出名的產品之一，其中還包括有分散式日誌解決方案 ELK（Elastic Search、Logstash、Kibana）、Beats、ECE等。

Elasticsearch

官網：https://www.elastic.co/cn/products/elasticsearch

Elasticsearch is a distributed, RESTful search and analytics engine capable of solving a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data so you can discover the expected and uncover the unexpected.

翻譯：

Elasticsearch 是一個分散式的基於 RESTful 介面的搜尋和分析引擎，它能夠解決越來越多的使用場景。作為 Elastic Stack 的核心，它集中儲存資料，可以發現預期及之外的結果。

Elastic Stack 的核心

Elasticsearch 是一個分散式、RESTful 風格的搜尋和資料分析引擎，能夠解決不斷湧現出的各種用例。作為 Elastic Stack 的核心，它集中儲存您的資料，幫助您發現意料之中以及意料之外的情況。

Elastic Stack 的特點：

查詢 保持好奇心。從資料中探尋各種問題的答案。

通過 Elasticsearch，您能夠執行及合併多種型別的搜尋（結構化資料、非結構化資料、地理位置、指標），搜尋方式隨心而變。先從一個簡單的問題出發，試試看能夠從中發現些什麼。

分析 大處著眼，全域性在握。

找到與查詢最匹配的十個文件是一回事。但如果面對的是十億行日誌，又該如何解讀呢？Elasticsearch 聚合讓您能夠從大處著眼，探索資料的趨勢和模式。

速度 Elasticsearch 很快。快到不可思議。

如果您能夠立即獲得答案，您與資料的關係就會發生變化。這樣您就有條件進行迭代並涵蓋更大的範圍。

但是要達到這樣的速度並非易事。我們通過有限狀態轉換器實現了用於全文檢索的倒排索引，實現了用於儲存數值資料和地理位置資料的 BKD 樹，以及用於分析的列儲存。

而且由於每個資料都被編入了索引，因此您再也不用因為某些資料沒有索引而煩心。您可以用快到令人驚歎的速度使用和訪問您的所有資料。

可擴充套件性 可以在膝上型電腦上執行。也可以在承載了 PB 級資料的成百上千臺伺服器上執行。

原型環境和生產環境可無縫切換；無論 Elasticsearch 是在一個節點上執行，還是在一個包含 300 個節點的叢集上執行，您都能夠以相同的方式與 Elasticsearch 進行通訊。

它能夠水平擴充套件，每秒鐘可處理海量事件，同時能夠自動管理索引和查詢在叢集中的分佈方式，以實現極其流暢的操作。

彈性 我們在您高飛的時候保駕護航。

硬體故障。網路分割。Elasticsearch 為您檢測這些故障並確保您的叢集（和資料）的安全性和可用性。通過跨叢集複製功能，輔助叢集可以作為熱備份隨時投入使用。

Elasticsearch 執行在一個分散式的環境中，從設計之初就考慮到了這一點，目的只有一個，讓您永遠高枕無憂。

靈活性 具備多個案例場景？一個全有。

數字、文字、地理位置、結構化資料、非結構化資料。歡迎使用所有資料型別。

應用搜索、安全分析、指標或日誌分析只是全球眾多公司利用 Elasticsearch 解決各種挑戰的冰山一角。

操作的樂趣 享受更多成功的時刻，告別垂頭喪氣的失落

簡單的事情就該簡單做。我們確保 Elasticsearch 在任何規模下都能夠易於操作，而無需在功能和效能方面做出犧牲。

客戶端庫 使用您自己的程式語言與 Elasticsearch 進行互動

Elasticsearch 使用的是標準的 RESTful 風格的 API 和 JSON。此外，我們還構建和維護了很多其他語言的客戶端，例如 Java、Python、.NET、SQL 和 PHP。與此同時，我們的社群也貢獻了很多客戶端。這些客戶端使用起來簡單自然，而且就像 Elasticsearch 一樣，不會對您的使用方式進行限制。

盡享強大功能 延展 Elasticsearch

為您的叢集新增使用者名稱和密碼，監控 Elasticsearch 的效能表現，通過執行 Machine Learning 任務來發現異常等等，這些特性盡在 Elastic Stack 內建的多項功能。

通過 Security、Monitoring、Alerting、Reporting、Graph 關聯分析和 Machine Learning 等功能，獲得更優的使用體驗。

HADOOP 和 SPARK Elasticsearch 加 Hadoop

Hadoop 中有大量資料？您可以使用 Elasticsearch-Hadoop (ES-Hadoop)聯結器，利用 Elasticsearch 的實時搜尋和分析功能處理您的大資料。這是兩大領域最大優勢的融合。

基礎概念

我可以這樣說，學習完這些概念，你或許就能明白RESTful的含義了，所以，學習這些概念是很有必要的。

Near Realtime (NRT)

Elasticsearch is a near-realtime search platform. What this means is there is a slight latency (normally one second) from the time you index a document until the time it becomes searchable.

叢集（Cluster）

A cluster is a collection of one or more nodes (servers) that together holds your entire data and provides federated indexing and search capabilities across all nodes. A cluster is identified by a unique name which by default is "elasticsearch". This name is important because a node can only be part of a cluster if the node is set up to join the cluster by its name.

Make sure that you don’t reuse the same cluster names in different environments, otherwise you might end up with nodes joining the wrong cluster. For instance you could use logging-dev, logging-stage, and logging-prod for the development, staging, and production clusters.

Note that it is valid and perfectly fine to have a cluster with only a single node in it. Furthermore, you may also have multiple independent clusters each with its own unique cluster name.

節點（Node）

A node is a single server that is part of your cluster, stores your data, and participates in the cluster’s indexing and search capabilities. Just like a cluster, a node is identified by a name which by default is a random Universally Unique IDentifier (UUID) that is assigned to the node at startup. You can define any node name you want if you do not want the default. This name is important for administration purposes where you want to identify which servers in your network correspond to which nodes in your Elasticsearch cluster.

A node can be configured to join a specific cluster by the cluster name. By default, each node is set up to join a cluster named elasticsearch which means that if you start up a number of nodes on your network and—assuming they can discover each other—they will all automatically form and join a single cluster named elasticsearch.

In a single cluster, you can have as many nodes as you want. Furthermore, if there are no other Elasticsearch nodes currently running on your network, starting a single node will by default form a new single-node cluster named elasticsearch.

索引（Index）

An index is a collection of documents that have somewhat similar characteristics. For example, you can have an index for customer data, another index for a product catalog, and yet another index for order data. An index is identified by a name (that must be all lowercase) and this name is used to refer to the index when performing indexing, search, update, and delete operations against the documents in it.

In a single cluster, you can define as many indexes as you want.

型別（Type）

A type used to be a logical category/partition of your index to allow you to store different types of documents in the same index, e.g. one type for users, another type for blog posts. It is no longer possible to create multiple types in an index, and the whole concept of types will be removed in a later version. See Removal of mapping types for more.

文件（Document）

A document is a basic unit of information that can be indexed. For example, you can have a document for a single customer, another document for a single product, and yet another for a single order. This document is expressed in JSON (JavaScript Object Notation) which is a ubiquitous internet data interchange format.

Within an index/type, you can store as many documents as you want. Note that although a document physically resides in an index, a document actually must be indexed/assigned to a type inside an index.

Shards & Replicas

An index can potentially store a large amount of data that can exceed the hardware limits of a single node. For example, a single index of a billion documents taking up 1TB of disk space may not fit on the disk of a single node or may be too slow to serve search requests from a single node alone.

To solve this problem, Elasticsearch provides the ability to subdivide your index into multiple pieces called shards. When you create an index, you can simply define the number of shards that you want. Each shard is in itself a fully-functional and independent "index" that can be hosted on any node in the cluster.

Sharding is important for two primary reasons:

It allows you to horizontally split/scale your content volume
It allows you to distribute and parallelize operations across shards (potentially on multiple nodes) thus increasing performance/throughput

The mechanics of how a shard is distributed and also how its documents are aggregated back into search requests are completely managed by Elasticsearch and is transparent to you as the user.

In a network/cloud environment where failures can be expected anytime, it is very useful and highly recommended to have a failover mechanism in case a shard/node somehow goes offline or disappears for whatever reason. To this end, Elasticsearch allows you to make one or more copies of your index’s shards into what are called replica shards, or replicas for short.

Replication is important for two primary reasons:

It provides high availability in case a shard/node fails. For this reason, it is important to note that a replica shard is never allocated on the same node as the original/primary shard that it was copied from.
It allows you to scale out your search volume/throughput since searches can be executed on all replicas in parallel.

To summarize, each index can be split into multiple shards. An index can also be replicated zero (meaning no replicas) or more times. Once replicated, each index will have primary shards (the original shards that were replicated from) and replica shards (the copies of the primary shards).

The number of shards and replicas can be defined per index at the time the index is created. After the index is created, you may also change the number of replicas dynamically anytime. You can change the number of shards for an existing index using the _shrink and _split APIs, however this is not a trivial task and pre-planning for the correct number of shards is the optimal approach.

By default, each index in Elasticsearch is allocated 5 primary shards and 1 replica which means that if you have at least two nodes in your cluster, your index will have 5 primary shards and another 5 replica shards (1 complete replica) for a total of 10 shards per index.

結構

ElasticSearch 結構

上圖來自SpringBoot整合ElasticSearch及原始碼

安裝

配置：

cluster.name: es-wyf
node.name: master
path.data: /Users/wenyifeng/Software/elasticsearch/data/master/data
path.logs: /Users/wenyifeng/Software/elasticsearch/data/master/logs
network.host: 127.0.0.1
http.port: 9200
discovery.zen.ping.unicast.hosts: ["127.0.0.1"]
http.cors.enabled: true
http.cors.allow-origin: "*"
bootstrap.memory_lock: false
bootstrap.system_call_filter: false

說起配置，我是很頭疼的，看過視訊教程和很多博文，都失敗，最後在老大的幫助下，成功了，給了我如上配置。感謝我們老大對我的幫助。

Mac 安裝

#下載並解壓，進入目錄，後臺執行
./bin/elasticsearch -d

docker安裝

Pulling the image

Obtaining Elasticsearch for Docker is as simple as issuing a docker pull command against the Elastic Docker registry.
docker pull docker.elastic.co/elasticsearch/elasticsearch:6.6.1
Alternatively, you can download other Docker images that contain only features available under the Apache 2.0 license. To download the images, go to www.docker.elastic.co.

Running Elasticsearch from the command line

Development modeedit

Elasticsearch can be quickly started for development or testing use with the following command:
docker run -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" docker.elastic.co/elasticsearch/elasticsearch:6.6.1

官網教程：https://www.elastic.co/guide/en/elasticsearch/reference/6.6/docker.html#docker-cli-run-dev-mode

CentOS安裝

這個問題，問下運維的同學吧。

ElasticSearch Head

伺服器安裝

地址：https://github.com/mobz/elasticsearch-head

從git上下下來，解壓並進入，執行如下命令：

npm install
npm run start

瀏覽器外掛

搜尋 ElasticSearch Head

建立索引

假設我們建立一個學校，有一個初2一班，學生的屬性有：學號、姓名、年齡。

PUT http://localhost:9200/school

{
	"mappings":{
		"c2_1": {
			"properties":{
				"no":{
					"type":"keyword"
				},
				"name":{
					"type":"text"
				},
				"age":{
					"type":"integer"
				}
			}
		}
	}
}

{
    "acknowledged": true,
    "shards_acknowledged": true,
    "index": "school"
}

建立索引

索引結構

這樣就表示索引建立成功。

基本操作CRUD

增加

我們向裡面插入一條資料，例如學號201901，姓名張三，年齡20。

POST http://localhost:9200/school/c2_1

{
	"no":"201901",
	"name":"張三",
	"age":20
}

{
    "_index": "school",
    "_type": "c2_1",
    "_id": "8ygbK2kBenMJLC7I-EaK",
    "_version": 1,
    "result": "created",
    "_shards": {
        "total": 2,
        "successful": 2,
        "failed": 0
    },
    "_seq_no": 0,
    "_primary_term": 1
}

查詢

我們通過返回的id查詢一下:

GET http://localhost:9200/school/c2_1/8ygbK2kBenMJLC7I-EaK

{
    "_index": "school",
    "_type": "c2_1",
    "_id": "8ygbK2kBenMJLC7I-EaK",
    "_version": 1,
    "_seq_no": 0,
    "_primary_term": 1,
    "found": true,
    "_source": {
        "no": "201901",
        "name": "張三",
        "age": 20
    }
}

查詢出來了，這說明我們的增加和查詢操作都成功了。

修改

我們把張三的年齡修改為22.

PUT http://localhost:9200/school/c2_1/8ygbK2kBenMJLC7I-EaK

{
	"no":"201901",
	"name":"張三",
	"age":22
}

{
    "_index": "school",
    "_type": "c2_1",
    "_id": "8ygbK2kBenMJLC7I-EaK",
    "_version": 2,
    "result": "updated",
    "_shards": {
        "total": 2,
        "successful": 2,
        "failed": 0
    },
    "_seq_no": 1,
    "_primary_term": 1
}

查詢一下：

驗證查詢

與預期一致。

刪除

我們根據ID刪除資料

DELETE http://localhost:9200/school/c2_1/8ygbK2kBenMJLC7I-EaK

{
    "_index": "school",
    "_type": "c2_1",
    "_id": "8ygbK2kBenMJLC7I-EaK",
    "_version": 3,
    "result": "deleted",
    "_shards": {
        "total": 2,
        "successful": 2,
        "failed": 0
    },
    "_seq_no": 2,
    "_primary_term": 1
}

再查詢就沒有，如下返回：

{
    "_index": "school",
    "_type": "c2_1",
    "_id": "8ygbK2kBenMJLC7I-EaK",
    "found": false
}

刪除索引

刪除索引之後，索引下面的索引文件都將被刪除。

DELETE http://localhost:9200/school

{
    "acknowledged": true
}

高階查詢

介面

通用查詢API介面：http://localhost:9200/book/_search

提交方式，可以是GET，也可以是POST（JSON）。

構造資料

我們首先構造資料，如下

測試：book 索引

測試：book 資料

Query Context

Query Context：在查詢過程中，除了判斷文件是否滿足查詢條件外，Elasticsearch還會計算一個 _score 來標識匹配的程度，旨在判斷目標文件和查詢條件匹配的 有多好。簡單來說就是，匹配到了嗎？有多吻合呢?

常用查詢

全文字搜尋：針對文字型別的資料

欄位級別查詢：針對結構化資料，如數字、日期等

全文字匹配

搜尋：

{
	"query":{
		"match":{
			"author":"明日科技"
		}
	}
}

結果：

{
    "took": 4,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 1,
        "max_score": 0.9808292,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "EdWwL2kBvvhXwNB9h50h",
                "_score": 0.9808292,
                "_source": {
                    "title": "Java從入門到精通（第4版）（附光碟）",
                    "author": "明日科技",
                    "word_count": 10002,
                    "publish_date": "2016-09-01"
                }
            }
        ]
    }
}

這是模糊匹配，先進行分詞，然後會把相關的都會查詢出來，如下：

搜尋：

{
	"query":{
		"match":{
			"title":"elasticsearch入門"
		}
	}
}

結果：

{
    "took": 4,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 4,
        "max_score": 0.3252806,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "FNW0L2kBvvhXwNB9pJ0W",
                "_score": 0.3252806,
                "_source": {
                    "title": "Python程式設計 從入門到實踐",
                    "author": "[美]埃裡克·馬瑟斯（Eric Matthes）",
                    "word_count": 10010,
                    "publish_date": "2016-07-10"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "EdWwL2kBvvhXwNB9h50h",
                "_score": 0.28924954,
                "_source": {
                    "title": "Java從入門到精通（第4版）（附光碟）",
                    "author": "明日科技",
                    "word_count": 10002,
                    "publish_date": "2016-09-01"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "EtWxL2kBvvhXwNB93p1F",
                "_score": 0.2876821,
                "_source": {
                    "title": "Elasticsearch實戰",
                    "author": "[美] 拉杜·喬戈（Radu Gheorghe） 馬修·李·欣曼（Matthew",
                    "word_count": 10005,
                    "publish_date": "2018-10-2"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "E9WzL2kBvvhXwNB9MZ3I",
                "_score": 0.21268348,
                "_source": {
                    "title": "Laravel入門與實戰 構建主流PHP應用開發框架 Laravel開發框架教程書籍 ",
                    "author": "拉杜 喬戈",
                    "word_count": 10007,
                    "publish_date": "2017-11-03"
                }
            }
        ]
    }
}

這裡將 elasticsearch入門 分解為 elasticsearch 和 入門。

match_phrase

如果我們並不想那樣進行分割，那我們換一個關鍵字 match_phrase

搜尋：

{
	"query":{
		"match_phrase":{
			"title":"elasticsearch入門"
		}
	}
}

結果：

{
    "took": 3,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 0,
        "max_score": null,
        "hits": []
    }
}

就什麼也沒有了。

我們再搜尋：

{
	"query":{
		"match_phrase":{
			"title":"elasticsearch"
		}
	}
}

結果：

{
    "took": 3,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 1,
        "max_score": 0.2876821,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "EtWxL2kBvvhXwNB93p1F",
                "_score": 0.2876821,
                "_source": {
                    "title": "Elasticsearch實戰",
                    "author": "[美] 拉杜·喬戈（Radu Gheorghe） 馬修·李·欣曼（Matthew",
                    "word_count": 10005,
                    "publish_date": "2018-10-2"
                }
            }
        ]
    }
}

我們再換關鍵字：

{
	"query":{
		"match_phrase":{
			"title":"入門"
		}
	}
}

結果：

{
    "took": 11,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 3,
        "max_score": 0.3252806,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "FNW0L2kBvvhXwNB9pJ0W",
                "_score": 0.3252806,
                "_source": {
                    "title": "Python程式設計 從入門到實踐",
                    "author": "[美]埃裡克·馬瑟斯（Eric Matthes）",
                    "word_count": 10010,
                    "publish_date": "2016-07-10"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "EdWwL2kBvvhXwNB9h50h",
                "_score": 0.28924954,
                "_source": {
                    "title": "Java從入門到精通（第4版）（附光碟）",
                    "author": "明日科技",
                    "word_count": 10002,
                    "publish_date": "2016-09-01"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "E9WzL2kBvvhXwNB9MZ3I",
                "_score": 0.21268348,
                "_source": {
                    "title": "Laravel入門與實戰 構建主流PHP應用開發框架 Laravel開發框架教程書籍 ",
                    "author": "拉杜 喬戈",
                    "word_count": 10007,
                    "publish_date": "2017-11-03"
                }
            }
        ]
    }
}

多個欄位查詢

搜尋：

{
	"query":{
		"multi_match":{
			"query":"java",
			"fields":["title", "author"]
		}
	}
}

結果：

{
    "took": 2,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 1,
        "max_score": 1.0623134,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "EdWwL2kBvvhXwNB9h50h",
                "_score": 1.0623134,
                "_source": {
                    "title": "Java從入門到精通（第4版）（附光碟）",
                    "author": "明日科技",
                    "word_count": 10002,
                    "publish_date": "2016-09-01"
                }
            }
        ]
    }
}

語法查詢

搜尋：

{
	"query":{
		"query_string":{
			"query":"java"
		}
	}
}

結果：

{
    "took": 6,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 1,
        "max_score": 1.0623134,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "EdWwL2kBvvhXwNB9h50h",
                "_score": 1.0623134,
                "_source": {
                    "title": "Java從入門到精通（第4版）（附光碟）",
                    "author": "明日科技",
                    "word_count": 10002,
                    "publish_date": "2016-09-01"
                }
            }
        ]
    }
}

搜尋：

{
	"query":{
		"query_string":{
			"query":"java and 入門"
		}
	}
}

結果：

{
    "took": 3,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 3,
        "max_score": 1.351563,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "EdWwL2kBvvhXwNB9h50h",
                "_score": 1.351563,
                "_source": {
                    "title": "Java從入門到精通（第4版）（附光碟）",
                    "author": "明日科技",
                    "word_count": 10002,
                    "publish_date": "2016-09-01"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "FNW0L2kBvvhXwNB9pJ0W",
                "_score": 0.3252806,
                "_source": {
                    "title": "Python程式設計 從入門到實踐",
                    "author": "[美]埃裡克·馬瑟斯（Eric Matthes）",
                    "word_count": 10010,
                    "publish_date": "2016-07-10"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "E9WzL2kBvvhXwNB9MZ3I",
                "_score": 0.21268348,
                "_source": {
                    "title": "Laravel入門與實戰 構建主流PHP應用開發框架 Laravel開發框架教程書籍 ",
                    "author": "拉杜 喬戈",
                    "word_count": 10007,
                    "publish_date": "2017-11-03"
                }
            }
        ]
    }
}

這個給我的個人感覺不好玩，就小小的嘗試一下吧。

欄位級別的查詢

搜尋：

{
	"query":{
		"term":{
			"word_count":"100"
		}
	}
}

結果：

{
    "took": 14,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 1,
        "max_score": 1,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "FdW1L2kBvvhXwNB91Z2M",
                "_score": 1,
                "_source": {
                    "title": "資料結構（C語言版）",
                    "author": "嚴蔚敏",
                    "word_count": 100,
                    "publish_date": "2007-03-09"
                }
            }
        ]
    }
}

term：用於查詢特定值

範圍查詢

例如，我們搜尋大於10000個字的書：

{
	"query":{
		"range":{
			"word_count":{
				"gte":10000
			}
		}
	}
}

結果：

{
    "took": 5,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 4,
        "max_score": 1,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "EtWxL2kBvvhXwNB93p1F",
                "_score": 1,
                "_source": {
                    "title": "Elasticsearch實戰",
                    "author": "[美] 拉杜·喬戈（Radu Gheorghe） 馬修·李·欣曼（Matthew",
                    "word_count": 10005,
                    "publish_date": "2018-10-2"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "EdWwL2kBvvhXwNB9h50h",
                "_score": 1,
                "_source": {
                    "title": "Java從入門到精通（第4版）（附光碟）",
                    "author": "明日科技",
                    "word_count": 10002,
                    "publish_date": "2016-09-01"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "E9WzL2kBvvhXwNB9MZ3I",
                "_score": 1,
                "_source": {
                    "title": "Laravel入門與實戰 構建主流PHP應用開發框架 Laravel開發框架教程書籍 ",
                    "author": "拉杜 喬戈",
                    "word_count": 10007,
                    "publish_date": "2017-11-03"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "FNW0L2kBvvhXwNB9pJ0W",
                "_score": 1,
                "_source": {
                    "title": "Python程式設計 從入門到實踐",
                    "author": "[美]埃裡克·馬瑟斯（Eric Matthes）",
                    "word_count": 10010,
                    "publish_date": "2016-07-10"
                }
            }
        ]
    }
}

時間也可以搜尋範圍，比如我們搜尋 (2016-09-01, 2018-01-01) 這個時間段之間要出版書：

{
	"query":{
		"range":{
			"publish_date":{
				"gt":"2016-09-01",
				"lt":"2018-01-01"
			}
		}
	}
}

結果：

{
    "took": 2,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 1,
        "max_score": 1,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "E9WzL2kBvvhXwNB9MZ3I",
                "_score": 1,
                "_source": {
                    "title": "Laravel入門與實戰 構建主流PHP應用開發框架 Laravel開發框架教程書籍 ",
                    "author": "拉杜 喬戈",
                    "word_count": 10007,
                    "publish_date": "2017-11-03"
                }
            }
        ]
    }
}

取等吧，[2016-09-01, 2018-01-01) ：

{
	"query":{
		"range":{
			"publish_date":{
				"gte":"2016-09-01",
				"lt":"2018-01-01"
			}
		}
	}
}

結果：

{
    "took": 2,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 2,
        "max_score": 1,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "EdWwL2kBvvhXwNB9h50h",
                "_score": 1,
                "_source": {
                    "title": "Java從入門到精通（第4版）（附光碟）",
                    "author": "明日科技",
                    "word_count": 10002,
                    "publish_date": "2016-09-01"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "E9WzL2kBvvhXwNB9MZ3I",
                "_score": 1,
                "_source": {
                    "title": "Laravel入門與實戰 構建主流PHP應用開發框架 Laravel開發框架教程書籍 ",
                    "author": "拉杜 喬戈",
                    "word_count": 10007,
                    "publish_date": "2017-11-03"
                }
            }
        ]
    }
}

當前日期，可用關鍵字 now

關鍵字：filter

在查詢過程中，只判斷文件是否滿足條件，只有Yes或者No。

舉個例子，我們要搜尋字數是100的有哪些，搜尋如下：

{
	"query":{
		"bool":{
			"filter":{
				"term":{
					"word_count":100
				}
			}
		}
	}
}

結果：

{
    "took": 40,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 1,
        "max_score": 0,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "FdW1L2kBvvhXwNB91Z2M",
                "_score": 0,
                "_source": {
                    "title": "資料結構（C語言版）",
                    "author": "嚴蔚敏",
                    "word_count": 100,
                    "publish_date": "2007-03-09"
                }
            }
        ]
    }
}

複雜查詢

固定分數查詢：constant_score

{
	"query":{
		"constant_score":{
			"filter":{
				"match":{
					"title":"ElasticSearch"
				}
			},
			"boost":2
		}
		
	}
}

不支援 match查詢，支援filter查詢。

布林查詢：bool

搜尋：

{
    "query": {
        "bool": {
            "should": [
                {
                    "match": {
                        "author": "明日科技"
                    }
                },
                {
                    "match": {
                        "title": "ElasticSearch"
                    }
                }
            ]
        }
    }
}

結果：

{
    "took": 4,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 2,
        "max_score": 0.9808292,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "EdWwL2kBvvhXwNB9h50h",
                "_score": 0.9808292,
                "_source": {
                    "title": "Java從入門到精通（第4版）（附光碟）",
                    "author": "明日科技",
                    "word_count": 10002,
                    "publish_date": "2016-09-01"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "EtWxL2kBvvhXwNB93p1F",
                "_score": 0.2876821,
                "_source": {
                    "title": "Elasticsearch實戰",
                    "author": "[美] 拉杜·喬戈（Radu Gheorghe） 馬修·李·欣曼（Matthew",
                    "word_count": 10005,
                    "publish_date": "2018-10-2"
                }
            }
        ]
    }
}

是 OR 的關係

看一下 AND 關係：

{
    "query": {
        "bool": {
            "must": [
                {
                    "match": {
                        "author": "明日科技"
                    }
                },
                {
                    "match": {
                        "title": "ElasticSearch"
                    }
                }
            ]
        }
    }
}

結果：

{
    "took": 3,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 0,
        "max_score": null,
        "hits": []
    }
}

我們換一下關鍵字，搜尋：

{
    "query": {
        "bool": {
            "must": [
                {
                    "match": {
                        "author": "明日科技"
                    }
                },
                {
                    "match": {
                        "title": "java"
                    }
                }
            ]
        }
    }
}

結果：

{
    "took": 13,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 1,
        "max_score": 2.0431426,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "EdWwL2kBvvhXwNB9h50h",
                "_score": 2.0431426,
                "_source": {
                    "title": "Java從入門到精通（第4版）（附光碟）",
                    "author": "明日科技",
                    "word_count": 10002,
                    "publish_date": "2016-09-01"
                }
            }
        ]
    }
}

加攔截條件，我們檢視字數是10000的：

{
    "query": {
        "bool": {
            "must": [
                {
                    "match": {
                        "author": "明日科技"
                    }
                },
                {
                    "match": {
                        "title": "java"
                    }
                }
            ],
            "filter": [
                {
                    "term": {
                        "word_count": 10000
                    }
                }
            ]
        }
    }
}

結果：

{
    "took": 2,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 0,
        "max_score": null,
        "hits": []
    }
}

好吧，我們將word_count換成10002：

{
    "query": {
        "bool": {
            "must": [
                {
                    "match": {
                        "author": "明日科技"
                    }
                },
                {
                    "match": {
                        "title": "java"
                    }
                }
            ],
            "filter":[{
            	"term":{
            		"word_count":10002
            	}
            }]
        }
    }
}

結果：

{
    "took": 3,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 1,
        "max_score": 2.0431426,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "EdWwL2kBvvhXwNB9h50h",
                "_score": 2.0431426,
                "_source": {
                    "title": "Java從入門到精通（第4版）（附光碟）",
                    "author": "明日科技",
                    "word_count": 10002,
                    "publish_date": "2016-09-01"
                }
            }
        ]
    }
}

關鍵字：must_not

例如，我不看java：

{
	"query":{
		"bool":{
			"must_not":{
				"term":{
					"title":"java"
				}
			}
		}
	}
}

結果：

{
    "took": 5,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 4,
        "max_score": 1,
        "hits": [
            {
                "_index": "book",
                "_type": "it",
                "_id": "FdW1L2kBvvhXwNB91Z2M",
                "_score": 1,
                "_source": {
                    "title": "資料結構（C語言版）",
                    "author": "嚴蔚敏",
                    "word_count": 100,
                    "publish_date": "2007-03-09"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "EtWxL2kBvvhXwNB93p1F",
                "_score": 1,
                "_source": {
                    "title": "Elasticsearch實戰",
                    "author": "[美] 拉杜·喬戈（Radu Gheorghe） 馬修·李·欣曼（Matthew",
                    "word_count": 10005,
                    "publish_date": "2018-10-2"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "E9WzL2kBvvhXwNB9MZ3I",
                "_score": 1,
                "_source": {
                    "title": "Laravel入門與實戰 構建主流PHP應用開發框架 Laravel開發框架教程書籍 ",
                    "author": "拉杜 喬戈",
                    "word_count": 10007,
                    "publish_date": "2017-11-03"
                }
            },
            {
                "_index": "book",
                "_type": "it",
                "_id": "FNW0L2kBvvhXwNB9pJ0W",
                "_score": 1,
                "_source": {
                    "title": "Python程式設計 從入門到實踐",
                    "author": "[美]埃裡克·馬瑟斯（Eric Matthes）",
                    "word_count": 10010,
                    "publish_date": "2016-07-10"
                }
            }
        ]
    }
}

關於搜尋，這只是入門，我們會在第三節會繼續討論搜尋。

Elasticsearch入門篇——基礎知識

Elastic

Elasticsearch

Elastic Stack 的核心

Elastic Stack 的特點：

基礎概念

安裝

Mac 安裝

docker安裝

Pulling the image

Running Elasticsearch from the command line

Development modeedit

CentOS安裝

ElasticSearch Head

伺服器安裝

瀏覽器外掛

建立索引

基本操作CRUD

增加

查詢

修改

刪除

刪除索引

高階查詢

介面

構造資料

Query Context

常用查詢

全文字匹配

match_phrase

多個欄位查詢

語法查詢

欄位級別的查詢

範圍查詢

關鍵字：filter

複雜查詢

布林查詢：bool

連結

ElasticSearch 學習系列

相關推薦