Elasticsearch常用命令

1.查询所有索引：
curl -XGET http://127.0.0.1:9200/_cat/indices?v

2.删除索引
curl -XDELETE http://guilin:9200/corp-data-v5
#删除多个指定索引，中间用逗号隔开
curl -XDELETE http://localhost:9200/acc-apply-2018.08.09,acc-apply-2018.08.10

#模糊匹配删除

curl -XDELETE  http://localhost:9200/acc-apply-*
{"acknowledged":true}
#使用通配符,删除所有的索引

curl -XDELETE http://localhost:9200/_all
或 curl -XDELETE http://localhost:9200/*
    _all ,* 通配所有的索引
    通常不建议使用通配符，误删了后果就很严重了，所有的index都被删除了
    禁止通配符为了安全起见，可以在elasticsearch.yml配置文件中设置禁用_all和*通配符
    action.destructive_requires_name = true
    这样就不能使用_all和*了

3.获取mapping
GET http://guilin:9200/corp-data/_mapping/corp-type

如果存储不够可以设置定时删除，下面是保留3天的日志

30 2 * * * /usr/bin/curl -XDELETE  http://localhost:9200/*-$(date -d '-3days' +'%Y.%m.%d') >/dev/null 2>&1
以下是定时删除脚本：

#!/bin/bash
time=$(date -d '-3days' +'%Y.%m.%d')
curl -XDELETE  http://localhost:9200/*-${time}

4.别名
POST http://guilin:9200/_aliases
{
    "actions": [{
            "add": {
                "index": "corp-data-v5",
                "alias": "corp-data"
            }
        }
    ]
}

5.查看分词情况
GET http://guilin:9200/corp-data/_analyze?pretty&analyzer=ik_smart&text=橙子互联

6.搜索
POST http://guilin:9200/corp-data/_search?pretty
    1)指定字段{
        "query": {
            "match": {
                "name": "橙子互联"
            }
        }
    }
    2)搜索全部{
        "query": {
            "match": {
                "_all": "橙子互联"
            }
        }
    }

    3)搜索返回高亮{
        "query": {
            "match": {
                "name": "橙子互联"
            }
        },
        "highlight": {
            "pre_tags": ["<tag1>", "<tag2>"],
            "post_tags": ["</tag1>", "</tag2>"],
            "fields": {
                "name": {}
            }
        }

7.全文搜索
GET http://guilin:9200/corp-data/_search?q='橙子互联'

8.新建索引和mapping
PUT http://guilin:9200/test-index5
POST http://guilin:9200/test-index5/fulltext5/_mapping
{
    "properties": {
        "content": {
            "type": "text",
            "analyzer": "ik_max_word",
            "search_analyzer": "ik_max_word"
        }
    }
}

9.添加记录
POST http://guilin:9200/test-index5/fulltext5/1
{
    "content": "美国疫情"
}

10.时间聚合查询
ES默认会将时间戳认为是UTC时间，所以时间聚和的时候要指定time_zone，否则会不准确（默认 + 8h）
long字段不支持time_zone,
用offset代替，参考：https: //www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-datehistogram-aggregation.html

POST http://guilin:9200/corp-data/_search
{
    "size": 0,
    "aggs": {
        "days_count": {
            "date_histogram": {
                "field": "updatetime",
                "interval": "day",
                "offset": "-8h",
                "format": "yyyy-MM-dd"
            }
        }
    }
}

11.时间范围查询
POST http://guilin:9200/corp-data/_search
{
    "query": {
        "constant_score": {
            "filter": {
                "range": {
                    "updatetime": {
                        "gte": 1519833600000,
                        "lt": 1619862400000
                    }
                }
            }
        }
    }
}

12.bool查询
POST http://guilin:9200/corp-data/_search
{
    "query": {
        "bool": {
            "must": [{
                    "term": {
                        "level": "2"
                    }
                }
            ],
            "must_not": [{
                    "term": {
                        "code": ""
                    }
                }
            ],
            "must": [{
                    "term": {
                        "reg_num": ""
                    }
                }
            ]
        }
    }
}

13.bool + 聚合查询
POST http://guilin:9200/corp-data/_search
{
    "query": {
        "bool": {
            "must_not": [{
                    "term": {
                        "founded_date": ""
                    }
                }
            ]
        }
    },
    "size": 0,
    "aggs": {
        "data_level": {
            "terms": {
                "field": "level"
            }
        }
    }
}

14.设置最大返回记录数
PUT http://guilin:9200/corp-data/_settings
{
    "index": {
        "max_result_window": "50000000"
    }
}

15.更新所有索引参数
curl - XPUT 'http://localhost:9200/_all/_settings?preserve_existing=true' - d '{
"index.cache.field.expire" : "10m",
"index.cache.field.max_size" : "50000",
"index.cache.field.type" : "soft"
}'