es之增删改查

查询

index：
GET task_results/_search/

普通查询：
{"query":{"bool":{"must":[{"match":{"task_id":"xxx"}}]}}}

json嵌套查询：
{"query":{"nested":{"path":"cloud_result","query":{"bool":{"must":[{"match":{"cloud_result.label":xx}}]}}}}}

range 查询：
{"from":0,"size":10,"query":{"nested":{"path":"cloud_result","query":{"bool":{"must":[{"match":{"cloud_result.label":xx}},{"range":{"cloud_result.confidence":{"gte":0.8}}}]}}}}}

同时查询多个值，类型mysql中的in：
{"query":{"bool":{"must":[{"match":{"project_id":"1"}},{"terms":{"incident_type":[1,2]}}]}}}

排序：
{"from":0,"size":10,"query":{"nested":{"path":"cloud_result","query":{"bool":{"must":[{"match":{"cloud_result.label":113718644}},{"range":{"cloud_result.confidence":{"gte":0.8}}}]}}}},"sort":{"create_at":{"order":"desc"}}}

json嵌套+普通字段查询：
{"query":{"bool":{"must":[{"nested":{"path":"cloud_result","query":{"term":{"cloud_result.label":xxx}}}},{"term":{"project_id":29}}]}}}

match和term查询的区别
match

• match的查询词会被分词
• match_phrase 不会分词
• match_phrase 可对多个字段进行匹配

term

• term代表完全匹配，不进行分词器分析
• term 查询的字段需要在mapping的时候定义好，否则可能词被分词。传入指定的字符串，查不到数据

bool联合查询

• must should must_not
• must 完全匹配
• should 至少满足一个
• must_not不匹配

es聚合查询：
https://blog.csdn.net/qq_43588909/article/details/126381390

根据project_id分组：
{"size":0,"aggs":{"aggs.demo01":{"terms":{"field":"project_id","size":10,"order":{"_count":"asc"//根据统计条数升序，desc降序}}}}}

聚合后having：
{"size":0,"aggs":{"groupName":{"terms":{"field":"source"},"aggs":{"countSource":{"terms":{"field":"source","order":{"_count":"asc"}}},"having":{"bucket_selector":{"buckets_path":{"orderCount":"_count"},"script":{"source":"params.orderCount >1 "}}}}}}}

基于查询结果聚合： 查询project_id=12 and cloud_result.label=694547 group source
{"size":0,"query":{"bool":{"must":[{"nested":{"path":"cloud_result","query":{"match":{"cloud_result.label":xxx}}}},{"match":{"project_id":12}}]}},"aggs":{"groupName":{"terms":{"field":"source"},"aggs":{"countSource":{"terms":{"field":"source","order":{"_count":"asc"}}},"having":{"bucket_selector":{"buckets_path":{"orderCount":"_count"},"script":{"source":"params.orderCount >1 "}}}}}}}

聚合后查询：
{"query":{"range":{"Price":{"gte":50,"lte":500}}},"aggs":{"tags_bucket":{"terms":{"field":"Tags.keyword"}}},"post_filter":{"term":{"Tags.keyword":"xx"}}}

更新

1.覆盖式更新(会把旧数据替换掉)
PUT student-001/_doc/1?refresh=true
{"id":1,"name":"student-1","year":1}

2.部分更新
把 id 为1的数据的 name 字段更新
POST student-001/_update/1?refresh=true
{"doc":{"name":"student-123"}}

如果数据不存在，则作为新数据添加；如果数据已经存在，则更新旧数据,那么我们可以添加参数 doc_as_upsert
POST student-001/_update/1?refresh=true
{"doc":{"name":"student-23"},"doc_as_upsert":true}

使用脚本的方式来更新数据
POST student-001/_update/1?refresh=true
{"script":{"source":"ctx._source.name='student-1'"}}

新增

批量添加数据:
PUT edms_electric_fence_alarm_v1/_doc/18
{"event_id":"xxx","vehicle_id":"xx","vehicle_name":"","type":"ANOMALY_TYPE_OUTSIDE_AREA","location":{"type":"COORDINATE_SYSTEM_LLA","coordinate_system":"","x":121,"y":30,"z":0},"area_id":"xxx","area_points":[],"fence_id":"","fence_name":""}

删除

根据查询条件删除：
POST task_results/_delete_by_query
{"query":{"bool":{"must":[{"match":{"project_id":12}},{"match":{"organization_id":"maint"}}]}}}