1.查询所有索引:
curl -XGET http://127.0.0.1:9200/_cat/indices?v
2.删除索引
curl -XDELETE http://guilin:9200/corp-data-v5
#删除多个指定索引,中间用逗号隔开
curl -XDELETE http://localhost:9200/acc-apply-2018.08.09,acc-apply-2018.08.10
#模糊匹配删除
curl -XDELETE http://localhost:9200/acc-apply-*
{"acknowledged":true}
#使用通配符,删除所有的索引
curl -XDELETE http://localhost:9200/_all
或 curl -XDELETE http://localhost:9200/*
_all ,* 通配所有的索引
通常不建议使用通配符,误删了后果就很严重了,所有的index都被删除了
禁止通配符为了安全起见,可以在elasticsearch.yml配置文件中设置禁用_all和*通配符
action.destructive_requires_name = true
这样就不能使用_all和*了
3.获取mapping
GET http://guilin:9200/corp-data/_mapping/corp-type
如果存储不够可以设置定时删除,下面是保留3天的日志
30 2 * * * /usr/bin/curl -XDELETE http://localhost:9200/*-$(date -d '-3days' +'%Y.%m.%d') >/dev/null 2>&1
以下是定时删除脚本:
#!/bin/bash
time=$(date -d '-3days' +'%Y.%m.%d')
curl -XDELETE http://localhost:9200/*-${time}
4.别名
POST http://guilin:9200/_aliases
{
"actions": [{
"add": {
"index": "corp-data-v5",
"alias": "corp-data"
}
}
]
}
5.查看分词情况
GET http://guilin:9200/corp-data/_analyze?pretty&analyzer=ik_smart&text=橙子互联
6.搜索
POST http://guilin:9200/corp-data/_search?pretty
1)指定字段{
"query": {
"match": {
"name": "橙子互联"
}
}
}
2)搜索全部{
"query": {
"match": {
"_all": "橙子互联"
}
}
}
3)搜索返回高亮{
"query": {
"match": {
"name": "橙子互联"
}
},
"highlight": {
"pre_tags": ["<tag1>", "<tag2>"],
"post_tags": ["</tag1>", "</tag2>"],
"fields": {
"name": {}
}
}
7.全文搜索
GET http://guilin:9200/corp-data/_search?q='橙子互联'
8.新建索引和mapping
PUT http://guilin:9200/test-index5
POST http://guilin:9200/test-index5/fulltext5/_mapping
{
"properties": {
"content": {
"type": "text",
"analyzer": "ik_max_word",
"search_analyzer": "ik_max_word"
}
}
}
9.添加记录
POST http://guilin:9200/test-index5/fulltext5/1
{
"content": "美国疫情"
}
10.时间聚合查询
ES默认会将时间戳认为是UTC时间,所以时间聚和的时候要指定time_zone,否则会不准确(默认 + 8h)
long字段不支持time_zone,
用offset代替,参考:https: //www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-datehistogram-aggregation.html
POST http://guilin:9200/corp-data/_search
{
"size": 0,
"aggs": {
"days_count": {
"date_histogram": {
"field": "updatetime",
"interval": "day",
"offset": "-8h",
"format": "yyyy-MM-dd"
}
}
}
}
11.时间范围查询
POST http://guilin:9200/corp-data/_search
{
"query": {
"constant_score": {
"filter": {
"range": {
"updatetime": {
"gte": 1519833600000,
"lt": 1619862400000
}
}
}
}
}
}
12.bool查询
POST http://guilin:9200/corp-data/_search
{
"query": {
"bool": {
"must": [{
"term": {
"level": "2"
}
}
],
"must_not": [{
"term": {
"code": ""
}
}
],
"must": [{
"term": {
"reg_num": ""
}
}
]
}
}
}
13.bool + 聚合查询
POST http://guilin:9200/corp-data/_search
{
"query": {
"bool": {
"must_not": [{
"term": {
"founded_date": ""
}
}
]
}
},
"size": 0,
"aggs": {
"data_level": {
"terms": {
"field": "level"
}
}
}
}
14.设置最大返回记录数
PUT http://guilin:9200/corp-data/_settings
{
"index": {
"max_result_window": "50000000"
}
}
15.更新所有索引参数
curl - XPUT 'http://localhost:9200/_all/_settings?preserve_existing=true' - d '{
"index.cache.field.expire" : "10m",
"index.cache.field.max_size" : "50000",
"index.cache.field.type" : "soft"
}'
Elasticsearch常用命令
未经允许不得转载:陈桂林博客 » Elasticsearch常用命令