ElasticSearch必知必会-基础篇
商业发展与职能技术部-体验保障研发组 康睿 姚再毅 李振 刘斌 王北永
说明：以下全部均基于eslaticsearch 8.1 版本
一.索引的定义
索引的全局认知
| ElasticSearch | Mysql |
|---|---|
| Index | Table |
| Type废弃 | Table废弃 |
| Document | Row |
| Field | Column |
| Mapping | Schema |
| Everything is indexed | Index |
| Query DSL | SQL |
| GET 010K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8W2)9J5k6g2)9J5k6g2)9J5k6b7`.`. | select * from |
| POST b8cK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8W2)9J5k6g2)9J5k6g2)9J5k6b7`.`. | update table set ... |
| Aggregations | group by\sum\sum |
| cardinality | 去重 distinct |
| reindex | 数据迁移 |
索引的定义
定义： 相同文档结构（Mapping）文档的结合 由唯一索引名称标定 一个集群中有多个索引 不同的索引代表不同的业务类型数据 注意事项： 索引名称不支持大写 索引名称最大支持255个字符长度 字段的名称，支持大写，不过建议全部统一小写
索引的创建
index-settings 参数解析
注意： 静态参数索引创建后，不再可以修改，动态参数可以修改 思考： 一、为什么主分片创建后不可修改？ A document is routed to a particular shard in an index using the following formula: <shard_num = hash(_routing) % num_primary_shards> the defalue value userd for _routing is the document`s _id es中写入数据，是根据上述的公式计算文档应该存储在哪个分片中，后续的文档读取也是根据这个公式，一旦分片数改变，数据也就找不到了 简单理解 根据ID做Hash 然后再 除以 主分片数 取余，被除数改变，结果就不一样了 二、如果业务层面根据数据情况，确实需要扩展主分片数，那怎么办？ reindex 迁移数据到另外一个索引 dd8K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3k6r3!0U0M7#2)9J5k6s2u0W2K9h3&6V1k6i4S2Q4x3X3g2Z5N6r3#2D9
索引的基本操作
二.Mapping-Param之dynamic
官网文档地址：a14K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3k6s2W2F1j5h3#2A6j5#2)9J5k6h3S2@1L8h3H3`.
核心功能
自动检测字段类型后添加字段 也就是哪怕你没有在es的mapping中定义该字段，es也会动态的帮你检测字段类型
初识dynamic
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 | // 删除test01索引，保证这个索引现在是干净的DELETE test01// 不定义mapping，直接一条插入数据试试看,POST test01/_doc/1{ "name":"kangrui10"}// 然后我们查看test01该索引的mapping结构 看看name这个字段被定义成了什么类型// 由此可以看出，name一级为text类型，二级定义为keyword，但其实这并不是我们想要的结果，// 我们业务查询中name字段并不会被分词查询，一般都是全匹配(and name = xxx)// 以下的这种结果，我们想要实现全匹配 就需要 name.keyword = xxx 反而麻烦GET test01/_mapping{ "test01" : { "mappings" : { "properties" : { "name" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } } } } }} |
dynamic的可选值
| 可选值 | 说明 | 解释 |
|---|---|---|
| true | New fields are added to the mapping (default). | 创建mapping时，如果不指定dynamic的值，默认true，即如果你的字段没有收到指定类型，就会es帮你动态匹配字段类型 |
| false | New fields are ignored. These fields will not be indexed or searchable, but will still appear in the _source field of returned hits. These fields will not be added to the mapping, and new fields must be added explicitly. | 若设置为false，如果你的字段没有在es的mapping中创建，那么新的字段，一样可以写入，但是不能被查询，mapping中也不会有这个字段，也就是被写入的字段，不会被创建索引 |
| strict | If new fields are detected, an exception is thrown and the document is rejected. New fields must be explicitly added to the mapping. | 若设置为strict，如果新的字段，没有在mapping中创建字段，添加会直接报错，生产环境推荐，更加严谨。示例如下,如要新增字段，就必须手动的新增字段 |
动态映射的弊端
- 字段匹配相对准确，但不一定是用户期望的
- 比如现在有一个text字段，es只会给你设置为默认的standard分词器，但我们一般需要的是ik中文分词器
- 占用多余的存储空间
- string类型匹配为text和keyword两种类型，意味着会占用更多的存储空间
- mapping爆炸
- 如果不小心写错了查询语句，get用成了put误操作，就会错误创建很多字段
三.Mapping-Param之doc_values
官网文档地址：0afK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3k6r3!0U0i4K6u0V1N6X3q4D9N6h3g2K6i4K6u0W2K9s2c8E0L8l9`.`.
核心功能
DocValue其实是Lucene在构建倒排索引时，会额外建立一个有序的正排索引（基于document => field value的映射列表） DocValue本质上是一个序列化的 列式存储，这个结构非常适用于聚合（aggregations）、排序（Sorting）、脚本（scripts access to field）等操作。而且，这种存储方式也非常便于压缩，特别是数字类型。这样可以减少磁盘空间并且提高访问速度。 几乎所有字段类型都支持DocValue，除了text和annotated_text字段。
何为正排索引
正排索引其实就是类似于数据库表，通过id和数据进行关联，通过搜索文档id，来获取对应的数据
doc_values可选值
- true：默认值，默认开启
- false：需手动指定，设置为false后，sort、aggregate、access the field from script将会无法使用，但会节省磁盘空间
真题演练
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | // 创建一个索引，test03，字段满足以下条件// 1. speaker: keyword// 2. line_id: keyword and not aggregateable// 3. speech_number: integerPUT test03{ "mappings": { "properties": { "speaker": { "type": "keyword" }, "line_id":{ "type": "keyword", "doc_values": false }, "speech_number":{ "type": "integer" } } }} |
四.分词器analyzers
ik中文分词器安装
何为倒排索引
数据索引化的过程
分词器的分类
官网地址: 021K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3j5h3&6S2L8s2W2K6K9i4y4Q4x3X3c8S2L8X3q4D9P5i4A6W2M7Y4y4Q4x3X3g2Z5N6r3#2D9
五.自定义分词
自定义分词器三段论
1.Character filters 字符过滤
HTML Strip Character Filter：用途：删除HTML元素，如 <b>，并解 码HTML实体，如＆amp
Mapping Character Filter：用途：替换指定字符
Pattern Replace Character Filter：用途：基于正则表达式替换指定字符
2.Tokenizer 文本切为分词
3.Token filters 分词后再过滤
官网文档地址：3a5K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3j5h3&6S2L8s2W2K6K9i4y4Q4x3X3c8@1L8$3E0W2L8X3k6A6L8s2c8W2M7Y4y4Q4x3X3g2Z5N6r3#2D9 可配置0个或多个 分词后再加工，比如转小写、删除某些特殊的停用词、增加同义词等
真题演练
有一个文档，内容类似 dag & cat, 要求索引这个文档，并且使用match_parase_query, 查询dag & cat 或者 dag and cat,都能够查到 题目分析： 1.何为match_parase_query：match_phrase 会将检索关键词分词。match_phrase的分词结果必须在被检索字段的分词中都包含，而且顺序必须相同，而且默认必须都是连续的。 2.要实现 & 和 and 查询结果要等价，那么就需要自定义分词器来实现了，定制化的需求 3.如何自定义一个分词器：20cK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3j5h3&6S2L8s2W2K6K9i4y4Q4x3X3c8U0N6i4y4@1L8$3#2Q4x3X3c8S2L8X3q4D9P5i4A6W2M7W2)9J5k6h3S2@1L8h3H3`. 4.解法1核心使用功能点，Mapping Character Filter 5.解法2核心使用功能点，12aK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3j5h3&6S2L8s2W2K6K9i4y4Q4x3X3c8K6P5h3&6G2L8Y4W2E0i4K6u0V1N6r3!0C8k6h3&6X3K9h3I4@1k6i4u0Q4x3X3g2Z5N6r3#2D9
解法1
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 | # 新建索引PUT /test01{ "settings": { "analysis": { "analyzer": { "my_analyzer": { "char_filter": [ "my_mappings_char_filter" ], "tokenizer": "standard", } }, "char_filter": { "my_mappings_char_filter": { "type": "mapping", "mappings": [ "& => and" ] } } } }, "mappings": { "properties": { "content":{ "type": "text", "analyzer": "my_analyzer" } } }}// 说明// 三段论之Character filters，使用char_filter进行文本替换// 三段论之Token filters，使用默认分词器// 三段论之Token filters，未设定// 字段content 使用自定义分词器my_analyzer# 填充测试数据PUT test01/_bulk{"index":{"_id":1}}{"content":"doc & cat"}{"index":{"_id":2}}{"content":"doc and cat"}# 执行测试,doc & cat || oc and cat 结果输出都为两条POST test01/_search{ "query": { "bool": { "must": [ { "match_phrase": { "content": "doc & cat" } } ] } }} |
解法2
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 | # 解题思路，将& 和 and 设定为同义词，使用Token filters# 创建索引PUT /test02{ "settings": { "analysis": { "analyzer": { "my_synonym_analyzer": { "tokenizer": "whitespace", "filter": [ "my_synonym" ] } }, "filter": { "my_synonym": { "type": "synonym", "lenient": true, "synonyms": [ "& => and" ] } } } }, "mappings": { "properties": { "content": { "type": "text", "analyzer": "my_synonym_analyzer" } } }}// 说明// 三段论之Character filters，未设定// 三段论之Token filters，使用whitespace空格分词器，为什么不用默认分词器？因为默认分词器会把&分词后剔除了，就无法在去做分词后的过滤操作了// 三段论之Token filters，使用synony分词后过滤器，对&和and做同义词// 字段content 使用自定义分词器my_synonym_analyzer# 填充测试数据PUT test02/_bulk{"index":{"_id":1}}{"content":"doc & cat"}{"index":{"_id":2}}{"content":"doc and cat"}# 执行测试POST test02/_search{ "query": { "bool": { "must": [ { "match_phrase": { "content": "doc & cat" } } ] } }} |
六.multi-fields
官网文档地址：b92K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3L8i4g2D9N6r3W2Q4x3X3c8X3K9h3g2D9k6s2y4Q4x3X3g2Z5N6r3#2D9
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 | // 单字段多类型,比如一个字段我想设置两种分词器PUT my-index-000001{ "mappings": { "properties": { "city": { "type": "text", "analyzer":"standard", "fields": { "fieldText": { "type": "text", "analyzer":"ik_smart", } } } } }} |
七.runtime_field 运行时字段
官网文档地址：a45K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5k6h3S2@1L8h3H3`.
产生背景
假如业务中需要根据某两个数字类型字段的差值来排序，也就是我需要一个不存在的字段, 那么此时应该怎么办？ 当然你可以刷数，新增一个差值结果字段来实现，假如此时不允许你刷数新增字段怎么办？
解决方案
应用场景
- 在不重新建立索引的情况下，向现有文档新增字段
- 在不了解数据结构的情况下处理数据
- 在查询时覆盖从原索引字段返回的值
- 为特定用途定义字段而不修改底层架构
功能特性
- Lucene完全无感知，因没有被索引化，没有doc_values
- 不支持评分，因为没有倒排索引
- 打破传统先定义后使用的方式
- 能阻止mapping爆炸
- 增加了API的灵活性
- 注意，会使得搜索变慢
实际使用
- 运行时检索指定，即检索环节可使用（也就是哪怕mapping中没有这个字段，我也可以查询）
- 动态或静态mapping指定，即mapping环节可使用（也就是在mapping中添加一个运行时的字段）
真题演练1
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 | # 假定有以下索引和数据PUT test03{ "mappings": { "properties": { "emotion": { "type": "integer" } } }}POST test03/_bulk{"index":{"_id":1}}{"emotion":2}{"index":{"_id":2}}{"emotion":5}{"index":{"_id":3}}{"emotion":10}{"index":{"_id":4}}{"emotion":3}# 要求：emotion > 5, 返回emotion_falg = '1', # 要求：emotion < 5, 返回emotion_falg = '-1', # 要求：emotion = 5, 返回emotion_falg = '0', |
解法1
检索时指定运行时字段: 432K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3M7Y4g2F1N6r3W2E0k6g2)9J5k6s2y4W2j5i4u0U0K9q4)9J5k6s2u0W2M7i4g2W2M7%4c8Q4x3X3g2Z5N6r3#2D9 该字段本质上是不存在的，所以需要检索时要加上 fields *
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 | GET test03/_search{ "fields": [ "*" ], "runtime_mappings": { "emotion_falg": { "type": "keyword", "script": { "source": """ if(doc['emotion'].value>5)emit('1'); if(doc['emotion'].value<5)emit('-1'); if(doc['emotion'].value==5)emit('0'); """ } } }} |
解法2
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 | # 创建索引并指定运行时字段PUT test03_01{ "mappings": { "runtime": { "emotion_falg": { "type": "keyword", "script": { "source": """ if(doc['emotion'].value>5)emit('1'); if(doc['emotion'].value<5)emit('-1'); if(doc['emotion'].value==5)emit('0'); """ } } }, "properties": { "emotion": { "type": "integer" } } }}# 导入测试数据POST test03_01/_bulk{"index":{"_id":1}}{"emotion":2}{"index":{"_id":2}}{"emotion":5}{"index":{"_id":3}}{"emotion":10}{"index":{"_id":4}}{"emotion":3}# 查询测试GET test03_01/_search{ "fields": [ "*" ]} |
真题演练2
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 | # 有以下索引和数据PUT test04{ "mappings": { "properties": { "A":{ "type": "long" }, "B":{ "type": "long" } } }}PUT task04/_bulk{"index":{"_id":1}}{"A":100,"B":2}{"index":{"_id":2}}{"A":120,"B":2}{"index":{"_id":3}}{"A":120,"B":25}{"index":{"_id":4}}{"A":21,"B":25}# 需求：在task04索引里，创建一个runtime字段，其值是A-B，名称为A_B； 创建一个range聚合，分为三级：小于0，0-100，100以上；返回文档数// 使用知识点：// 1.检索时指定运行时字段: https://eb6K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2D9j5i4y4@1K9h3y4Q4x3X3g2U0L8H3`.`./guide/en/elasticsearch/reference/8.1/runtime-search-request.html// 2.范围聚合 https://958K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2D9j5i4y4@1K9h3y4Q4x3X3g2U0L8H3`.`./guide/en/elasticsearch/reference/8.1/search-aggregations-bucket-range-aggregation.html |
解法
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 | # 结果测试GET task04/_search{ "fields": [ "*" ], "size": 0, "runtime_mappings": { "A_B": { "type": "long", "script": { "source": """ emit(doc['A'].value - doc['B'].value); """ } } }, "aggs": { "price_ranges_A_B": { "range": { "field": "A_B", "ranges": [ { "to": 0 }, { "from": 0, "to": 100 }, { "from": 100 } ] } } }} |
八.Search-highlighted
highlighted语法初识
官网文档地址：77eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3K9r3W2Y4K9r3I4A6k6$3S2@1K9h3&6Y4i4K6u0W2K9s2c8E0L8l9`.`.
九.Search-Order
Order语法初识
官网文档地址： b5aK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3M7$3!0J5N6q4)9J5k6s2y4W2j5i4u0U0K9q4)9J5k6s2u0W2M7%4g2D9N6s2y4Q4x3X3g2Z5N6r3#2D9
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 | // 注意：text类型默认是不能排或聚合的，如果非要排序或聚合，需要开启fielddataGET /kibana_sample_data_ecommerce/_search{ "query": { "match": { "customer_last_name": "wood" } }, "highlight": { "number_of_fragments": 3, "fragment_size": 150, "fields": { "customer_last_name": { "pre_tags": [ "<em>" ], "post_tags": [ "</em>" ] } } }, "sort": [ { "currency": { "order": "desc" }, "_score": { "order": "asc" } } ]} |
十.Search-Page
page语法初识
官网文档地址：289K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3M7r3q4Y4K9h3&6S2N6r3g2Q4x3X3c8K6k6h3q4J5j5$3S2Q4x3X3c8J5k6i4y4#2L8s2c8K6i4K6u0W2K9s2c8E0L8l9`.`.
1 2 3 4 5 6 7 8 9 10 11 | # 注意 from的起始值是 0 不是 1GET kibana_sample_data_ecommerce/_search{ "from": 5, "size": 20, "query": { "match": { "customer_last_name": "wood" } }} |
真题演练1
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 | # 题目In the spoken lines of the play, highlight the word Hamlet (int the text_entry field) startint the highlihnt with "#aaa#" and ending it with "#bbb#"return all of speech_number field lines in reverse order; '20' speech lines per page,starting from line '40'# highlight 处理 text_entry 字段 ； 关键词 Hamlet 高亮# page分页：from：40；size:20# speech_number：倒序POST test09/_search{ "from": 40, "size": 20, "query": { "bool": { "must": [ { "match": { "text_entry": "Hamlet" } } ] } }, "highlight": { "fields": { "text_entry": { "pre_tags": [ "#aaa#" ], "post_tags": [ "#bbb#" ] } } }, "sort": [ { "speech_number.keyword": { "order": "desc" } } ]} |
十一.Search-AsyncSearch
官网文档地址：c29K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3j5i4y4&6L8X3y4Q4x3X3c8K6k6h3q4J5j5$3S2Q4x3X3g2Z5N6r3#2D9
发行版本
7.7.0
适用场景
允许用户在异步搜索结果时可以检索，从而消除了仅在查询完成后才等待最终响应的情况
常用命令
- 执行异步检索
- POST /sales*/_async_search?size=0
- 查看异步检索
- GET /_async_search/id值
- 查看异步检索状态
- GET /_async_search/id值
- 删除、终止异步检索
- DELETE /_async_search/id值
异步查询结果说明
| 返回值 | 含义 |
|---|---|
| id | 异步检索返回的唯一标识符 |
| is_partial | 当查询不再运行时，指示再所有分片上搜索是成功还是失败。在执行查询时，is_partial=true |
| is_running | 搜索是否仍然再执行 |
| total | 将在多少分片上执行搜索 |
| successful | 有多少分片已经成功完成搜索 |
十二.Aliases索引别名
官网文档地址：7b7K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3j5h3I4A6j5i4y4W2M7#2)9J5k6h3S2@1L8h3H3`.
Aliases的作用
在ES中，索引别名（index aliases）就像一个快捷方式或软连接，可以指向一个或多个索引。别名带给我们极大的灵活性，我们可以使用索引别名实现以下功能：
- 在一个运行中的ES集群中无缝的切换一个索引到另一个索引上（无需停机）
- 分组多个索引，比如按月创建的索引，我们可以通过别名构造出一个最近3个月的索引
- 查询一个索引里面的部分数据构成一个类似数据库的视图（views
假设没有别名，如何处理多索引的检索
方式1：POST index_01,index_02.index_03/_search 方式2：POST index*/search
创建别名的三种方式
- 创建索引的同时指定别名
1 2 3 4 5 6 7 8 9 10 11 12 13 14 | # 指定test05的别名为 test05_aliasesPUT test05{ "mappings": { "properties": { "name":{ "type": "keyword" } } }, "aliases": { "test05_aliases": {} }} |
- 使用索引模板的方式指定别名
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 | PUT _index_template/template_1{ "index_patterns": ["te*", "bar*"], "template": { "settings": { "number_of_shards": 1 }, "mappings": { "_source": { "enabled": true }, "properties": { "host_name": { "type": "keyword" }, "created_at": { "type": "date", "format": "EEE MMM dd HH:mm:ss Z yyyy" } } }, "aliases": { "mydata": { } } }, "priority": 500, "composed_of": ["component_template1", "runtime_component_template"], "version": 3, "_meta": { "description": "my custom" }} |
- 对已有的索引创建别名
1 2 3 4 5 6 7 8 9 10 11 | POST _aliases{ "actions": [ { "add": { "index": "logs-nginx.access-prod", "alias": "logs" } } ]} |
删除别名
1 2 3 4 5 6 7 8 9 10 11 | POST _aliases{ "actions": [ { "remove": { "index": "logs-nginx.access-prod", "alias": "logs" } } ]} |
真题演练1
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 | # Define an index alias for 'accounts-row' called 'accounts-male': Apply a filter to only show the male account owners# 为'accounts-row'定义一个索引别名，称为'accounts-male':应用一个过滤器，只显示男性账户所有者POST _aliases{ "actions": [ { "add": { "index": "accounts-row", "alias": "accounts-male", "filter": { "bool": { "filter": [ { "term": { "gender.keyword": "male" } } ] } } } } ]} |
十三.Search-template
官网文档地址:3a4K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3M7$3g2S2M7X3y4Z5i4K6u0V1N6r3g2E0M7r3I4S2N6r3g2Q4x3X3g2Z5N6r3#2D9
功能特点
模板接受在运行时指定参数。搜索模板存储在服务器端，可以在不更改客户端代码的情况下进行修改。
初识search-template
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 | # 创建检索模板PUT _scripts/my-search-template{ "script": { "lang": "mustache", "source": { "query": { "match": { "{{query_key}}": "{{query_value}}" } }, "from": "{{from}}", "size": "{{size}}" } }}# 使用检索模板查询GET my-index/_search/template{ "id": "my-search-template", "params": { "query_key": "your filed", "query_value": "your filed value", "from": 0, "size": 10 }} |
索引模板的操作
创建索引模板
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 | PUT _scripts/my-search-template{ "script": { "lang": "mustache", "source": { "query": { "match": { "message": "{{query_string}}" } }, "from": "{{from}}", "size": "{{size}}" }, "params": { "query_string": "My query string" } }} |
验证索引模板
1 2 3 4 5 6 7 8 9 | POST _render/template{ "id": "my-search-template", "params": { "query_string": "hello world", "from": 20, "size": 10 }} |
执行检索模板
1 2 3 4 5 6 7 8 9 | GET my-index/_search/template{ "id": "my-search-template", "params": { "query_string": "hello world", "from": 0, "size": 10 }} |
获取全部检索模板
1 | GET _cluster/state/metadata?pretty&filter_path=metadata.stored_scripts |
删除检索模板
1 | DELETE _scripts/my-search-templateath=metadata.stored_scripts |
十四.Search-dsl 简单检索
官网文档地址：e5bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3M7i4g2W2M7Y4W2Q4x3X3c8V1M7$3I4Q4x3X3g2Z5N6r3#2D9
检索选型
检索分类
自定义评分
如何自定义评分
1.index Boost索引层面修改相关性
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 | // 一批数据里，有不同的标签，数据结构一致，不同的标签存储到不同的索引（A、B、C），最后要严格按照标签来分类展示的话，用什么查询比较好?// 要求：先展示A类，然后B类，然后C类# 测试数据如下put /index_a_123/_doc/1{ "title":"this is index_a..."}put /index_b_123/_doc/1{ "title":"this is index_b..."}put /index_c_123/_doc/1{ "title":"this is index_c..."}# 普通不指定的查询方式，该查询方式下，返回的三条结果数据评分是相同的POST index_*_123/_search{ "query": { "bool": { "must": [ { "match": { "title": "this" } } ] } }}官网文档地址：https://dcbK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2D9j5i4y4@1K9h3y4Q4x3X3g2U0L8H3`.`./guide/en/elasticsearch/reference/8.1/search-search.htmlindices_boost# 也就是索引层面提升权重POST index_*_123/_search{ "indices_boost": [ { "index_a_123": 10 }, { "index_b_123": 5 }, { "index_c_123": 1 } ], "query": { "bool": { "must": [ { "match": { "title": "this" } } ] } }} |
2.boosting 修改文档相关性
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 | 某索引index_a有多个字段， 要求实现如下的查询：1）针对字段title，满足'ssas'或者'sasa’。2）针对字段tags（数组字段），如果tags字段包含'pingpang',则提升评分。要求：写出实现的DSL？# 测试数据如下put index_a/_bulk{"index":{"_id":1}}{"title":"ssas","tags":"basketball"}{"index":{"_id":2}}{"title":"sasa","tags":"pingpang; football"}# 解法1POST index_a/_search{ "query": { "bool": { "must": [ { "bool": { "should": [ { "match": { "title": "ssas" } }, { "match": { "title": "sasa" } } ] } } ], "should": [ { "match": { "tags": { "query": "pingpang", "boost": 1 } } } ] } }}# 解法2// https://a3eK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2D9j5i4y4@1K9h3y4Q4x3X3g2U0L8H3`.`./guide/en/elasticsearch/reference/8.1/query-dsl-function-score-query.htmlPOST index_a/_search{ "query": { "bool": { "should": [ { "function_score": { "query": { "match": { "tags": { "query": "pingpang" } } }, "boost": 1 } } ], "must": [ { "bool": { "should": [ { "match": { "title": "ssas" } }, { "match": { "title": "sasa" } } ] } } ] } }} |
3.negative_boost降低相关性
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 | 对于某些结果不满意，但又不想通过 must_not 排除掉，可以考虑可以考虑boosting query的negative_boost。即：降低评分negative_boost(Required, float) Floating point number between 0 and 1.0 used to decrease the relevance scores of documents matching the negative query.官网文档地址：https://c5cK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2D9j5i4y4@1K9h3y4Q4x3X3g2U0L8H3`.`./guide/en/elasticsearch/reference/8.1/query-dsl-boosting-query.htmlPOST index_a/_search{ "query": { "boosting": { "positive": { "term": { "tags": "football" } }, "negative": { "term": { "tags": "pingpang" } }, "negative_boost": 0.5 } }} |
4.function_score 自定义评分
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 | 如何同时根据 销量和浏览人数进行相关度提升？问题描述：针对商品，例如有想要有一个提升相关度的计算，同时针对销量和浏览人数？例如oldScore*(销量+浏览人数)************************** 商品 销量 浏览人数 A 10 10 B 20 20C 30 30**************************# 示例数据如下 put goods_index/_bulk{"index":{"_id":1}}{"name":"A","sales_count":10,"view_count":10}{"index":{"_id":2}}{"name":"B","sales_count":20,"view_count":20}{"index":{"_id":3}}{"name":"C","sales_count":30,"view_count":30}官网文档地址：https://0a6K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2D9j5i4y4@1K9h3y4Q4x3X3g2U0L8H3`.`./guide/en/elasticsearch/reference/8.1/query-dsl-function-score-query.html知识点：script_scorePOST goods_index/_search{ "query": { "function_score": { "query": { "match_all": {} }, "script_score": { "script": { "source": "_score * (doc['sales_count'].value+doc['view_count'].value)" } } } }} |
十五.Search-del Bool复杂检索
官网文档地址：4a8K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3M7i4g2W2M7Y4W2Q4x3X3c8V1M7$3I4Q4x3X3c8T1L8$3!0D9i4K6u0V1M7i4g2W2M7Y4W2Q4x3X3g2Z5N6r3#2D9
基本语法
真题演练
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 | 写一个查询，要求某个关键字再文档的四个字段中至少包含两个以上功能点：bool 查询，should / minimum_should_match 1.检索的bool查询 2.细节点 minimum_should_match注意：minimum_should_match 当有其他子句的时候，默认值为0，当没有其他子句的时候默认值为1POST test_index/_search{ "query": { "bool": { "should": [ { "match": { "filed1": "kr" } }, { "match": { "filed2": "kr" } }, { "match": { "filed3": "kr" } }, { "match": { "filed4": "kr" } } ], "minimum_should_match": 2 } }} |
十六.Search-Aggregations
官网文档地址：424K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3M7$3g2S2M7X3y4Z5i4K6u0V1j5h3N6Y4M7X3g2Y4j5i4c8A6L8$3&6K6i4K6u0W2K9s2c8E0L8l9`.`.
聚合分类
分桶聚合（bucket）
terms
1 2 3 4 5 6 7 8 9 10 11 12 13 14 | 官网文档地址：https://3ffK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2D9j5i4y4@1K9h3y4Q4x3X3g2U0L8H3`.`./guide/en/elasticsearch/reference/8.1/search-aggregations-bucket-terms-aggregation.html# 按照作者统计文档数POST bilili_elasticsearch/_search{ "size": 0, "aggs": { "agg_user": { "terms": { "field": "user", "size": 1 } } }} |
date_histogram
1 2 3 4 5 6 7 8 9 10 11 12 13 14 | 官网文档地址：https://1f5K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2D9j5i4y4@1K9h3y4Q4x3X3g2U0L8H3`.`./guide/en/elasticsearch/reference/8.1/search-aggregations-bucket-datehistogram-aggregation.html# 按照up_time 按月进行统计POST bilili_elasticsearch/_search{ "size": 0, "aggs": { "agg_up_time": { "date_histogram": { "field": "up_time", "calendar_interval": "month" } } }} |
指标聚合 （metrics）
Max
1 2 3 4 5 6 7 8 9 10 11 12 13 | 官网文档地址：https://f66K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2D9j5i4y4@1K9h3y4Q4x3X3g2U0L8H3`.`./guide/en/elasticsearch/reference/8.1/search-aggregations-metrics-max-aggregation.html# 获取up_time最大的POST bilili_elasticsearch/_search{ "size": 0, "aggs": { "agg_max_up_time": { "max": { "field": "up_time" } } }} |
Top_hits
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 | 官网文档地址：https://e8cK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2D9j5i4y4@1K9h3y4Q4x3X3g2U0L8H3`.`./guide/en/elasticsearch/reference/8.1/search-aggregations-metrics-top-hits-aggregation.html# 根据user聚合只取一个聚合结果，并且获取命中数据的详情前3条，并按照指定字段排序POST bilili_elasticsearch/_search{ "size": 0, "aggs": { "terms_agg_user": { "terms": { "field": "user", "size": 1 }, "aggs": { "top_user_hits": { "top_hits": { "_source": { "includes": [ "video_time", "title", "see", "user", "up_time" ] }, "sort": [ { "see":{ "order": "desc" } } ], "size": 3 } } } } }}// 返回结果如下{ "took" : 91, "timed_out" : false, "_shards" : { "total" : 1, "successful" : 1, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "value" : 1000, "relation" : "eq" }, "max_score" : null, "hits" : [ ] }, "aggregations" : { "terms_agg_user" : { "doc_count_error_upper_bound" : 0, "sum_other_doc_count" : 975, "buckets" : [ { "key" : "Elastic搜索", "doc_count" : 25, "top_user_hits" : { "hits" : { "total" : { "value" : 25, "relation" : "eq" }, "max_score" : null, "hits" : [ { "_index" : "bilili_elasticsearch", "_id" : "5ccCVoQBUyqsIDX6wIcm", "_score" : null, "_source" : { "video_time" : "03:45", "see" : "92", "up_time" : "2021-03-19", "title" : "Elastic 社区大会2021: 用加 Gatling 进行Elasticsearch的负载测试，寓教于乐。", "user" : "Elastic搜索" }, "sort" : [ "92" ] }, { "_index" : "bilili_elasticsearch", "_id" : "8scCVoQBUyqsIDX6wIgn", "_score" : null, "_source" : { "video_time" : "10:18", "see" : "79", "up_time" : "2020-10-20", "title" : "为Elasticsearch启动htpps访问", "user" : "Elastic搜索" }, "sort" : [ "79" ] }, { "_index" : "bilili_elasticsearch", "_id" : "7scCVoQBUyqsIDX6wIcm", "_score" : null, "_source" : { "video_time" : "04:41", "see" : "71", "up_time" : "2021-03-19", "title" : "Elastic 社区大会2021: Elasticsearch作为一个地理空间的数据库", "user" : "Elastic搜索" }, "sort" : [ "71" ] } ] } } } ] } }} |
子聚合 （Pipeline）
Pipeline：基于聚合的聚合 官网文档地址：74bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3M7$3g2S2M7X3y4Z5i4K6u0V1j5h3N6Y4M7X3g2Y4j5i4c8A6L8$3&6K6i4K6u0V1M7r3W2H3k6h3I4A6L8X3g2Q4x3X3g2Z5N6r3#2D9
bucket_selector
官网文档地址：701K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2W2L8r3q4K6N6r3W2U0i4K6u0W2j5$3!0Q4x3V1k6Y4N6h3W2V1k6g2)9J5c8X3g2F1i4K6u0r3k6h3I4S2M7%4c8A6j5%4y4W2j5i4u0U0K9q4)9J5c8Y4u0W2k6X3g2J5k6h3&6U0k6g2)9J5c8U0S2Q4x3X3f1I4i4K6u0r3M7$3g2S2M7X3y4Z5i4K6u0V1j5h3N6Y4M7X3g2Y4j5i4c8A6L8$3&6K6i4K6u0V1M7r3W2H3k6h3I4A6L8X3g2Q4x3X3c8T1N6h3y4C8k6i4c8Q4x3X3c8K6k6h3I4W2j5%4c8G2M7W2)9J5k6r3q4Y4k6%4u0W2k6$3q4@1K9h3!0F1i4K6u0W2K9s2c8E0L8l9`.`.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 | # 根据order_date按月分组，并且求销售总额大于1000POST kibana_sample_data_ecommerce/_search{ "size": 0, "aggs": { "date_his_aggs": { "date_histogram": { "field": "order_date", "calendar_interval": "month" }, "aggs": { "sum_aggs": { "sum": { "field": "total_unique_products" } }, "sales_bucket_filter": { "bucket_selector": { "buckets_path": { "totalSales": "sum_aggs" }, "script": "params.totalSales > 1000" } } } } }} |
真题演练
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 | earthquakes索引中包含了过去30个月的地震信息，请通过一句查询，获取以下信息l 过去30个月，每个月的平均 magl 过去30个月里，平均mag最高的一个月及其平均magl 搜索不能返回任何文档max_bucket 官网地址：https://8f8K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3g2D9j5i4y4@1K9h3y4Q4x3X3g2U0L8H3`.`./guide/en/elasticsearch/reference/8.1/search-aggregations-pipeline-max-bucket-aggregation.htmlPOST earthquakes/_search{ "size": 0, "query": { "range": { "time": { "gte": "now-30M/d", "lte": "now" } } }, "aggs": { "agg_time_his": { "date_histogram": { "field": "time", "calendar_interval": "month" }, "aggs": { "avg_aggs": { "avg": { "field": "mag" } } } }, "max_mag_sales": { "max_bucket": { "buckets_path": "agg_time_his>avg_aggs" } } }} |