集群和节点:
节点(node) 是一个运行着的Elasticsearch 实例, 集群(cluster）是一组具有相同cluster.name 的节点集合可以组成一个集群。
你最好找一个合适的名字带替换cluster.name的默认值,这样可以防止一个新启动的节点加入到相同的网络中
cluster.name: es_cluster
node.name: node01
path.data: /elk/elasticsearch/data
path.logs: /elk/elasticsearch/logs
network.host: 192.168.32.80
network.port: 9200
discovery.zen.ping.unicast.hosts: ["192.168.32.80", "192.168.32.81"]
http://192.168.32.81:9200/_count?pretty/
GET
{
"query": {
"match_all": {}
}
}
返回:
{
"count": 500,
"_shards": {
"total": 21,
"successful": 21,
"failed": 0
}
}
面向文档:
Relational DB -> Databases -> Tables -> Rows -> Columns
Elasticsearch -> Indices -> Types -> Documents -> Fields
索引->类型->文档->字段
Elasticsearch集群可以包含多个索引,每个索引可以包含多个类型的(type),
每个类型包含多个文档,然后每个文档包含多个字段
所以为了创建员工目录，我们将进行如下操作：
1.为每个员工的文档(document)建立索引，每个文档包含了相应员工的所有信息。
2.每个文档的类型为 employee 。
3.employee 类型归属于索引 megacorp 。
4.megacorp 索引存储在Elasticsearch集群中。
http://192.168.32.81:9200/megacorp/employee/1/
PUT
{
"first_name" : "John",
"last_name" : "Smith",
"age" : 25,
"about" : "I love to go rock climbing",
"interests": [ "sports", "music" ]
}
我们看到path: /megacorp/employee/1 包含三部分信息：
名字 说明
megacorp 索引名
employee 类型名
1 这个员工的ID
让我们在目录中加入更多额员工信息:
PUT /megacorp/employee/2
{
"first_name" : "Jane",
"last_name" : "Smith",
"age" : 32,
"about" : "I like to collect rock albums",
"interests": [ "music" ]
}
PUT /megacorp/employee/3
{
"first_name" : "Douglas",
"last_name" : "Fir",
"age" : 35,
"about": "I like to build cabinets",
"interests": [ "forestry" ]
}
Elasticsearch集群可以包含多个索引
检索文档:
http://192.168.32.80:9200/megacorp/employee/1/
GET
{
"_index": "megacorp",
"_type": "employee",
"_id": "1",
"_version": 1,
"found": true,
"_source": {
"first_name": "John",
"last_name": "Smith",
"age": 25,
"about": "I love to go rock climbing",
"interests": [
"sports"
,
"music"
]
}
}
我们通过HTTP 方法get来检索文档,同样的,我们可以使用DELETE 方法删除文档,
使用HEAD 方法检索某文档是否存在。如果想要更新已存在的文档,我们只需要PUT一次。
简单搜索:
GET 请求非常简单---你能轻松获取你想要的文档,让我们来进一步尝试一些东西,比如简单的搜索！
我们尝试一个最简单的搜索全部员工的请求:
http://192.168.32.80:9200/megacorp/employee/_search/
你可以看到我们依然使用megacorp 索引和employee 索引,但是我们在结尾使用关键字_search 来
取代原来的文档ID.响应内部的hits 数组包含了我们所有的三个文档,默认情况下搜索返回前10个结果
接下来,让我们搜索姓氏包含"Smith"的员工,要做到这一点,我们将在命令行中使用轻量级的搜索方法。
这种方法被称作查询字符串(query string)搜索,因为我们像传递URL参数一样去传递查询语句
curl localhost:9200/films/md/_search?q=tag:good
demo:/root# curl http://192.168.32.81:9200/megacorp/employee/_search?q=last_name:lee
{"took":6,"timed_out":false,"_shards":{"total":5,"successful":5,"failed":0},"hits":
{"total":1,"max_score":0.30685282,"hits":
[{"_index":"megacorp","_type":"employee","_id":"3","_score":0.30685282,"_source":
{"first_name":"Jane","last_name":"lee","age":32,"about":"I like to collect rock albums","interests":["music"]}}]}}
demo:/root#
http://192.168.32.81:9200/megacorp/employee/_search/
?q=last_name:lee GET
{
"took": 7,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 1,
"max_score": 0.30685282,
"hits": [
{
"_index": "megacorp",
"_type": "employee",
"_id": "3",
"_score": 0.30685282,
"_source": {
"first_name": "Jane",
"last_name": "lee",
"age": 32,
"about": "I like to collect rock albums",
"interests": [
"music"
]
}
}
]
}
使用DSL语句查询:
DSL 以JSON 请求体的形式出现,我们可以这样表示之前关于“Smith”的查询:
必须POST 请求:
http://192.168.32.81:9200/megacorp/employee/_search/
POST
{
"query" : {
"match" : {
"last_name" : "Smith"
}
}
}
更复杂的搜索:
我们让搜索稍微改变的复杂一些,我们依旧像要找到姓氏为"Smith"的员工,但是我们只想得到
年龄大于30岁的员工。 我们的语句将添加过滤器(filter)，它是得我们高效率的执行一个结果话的检索:
http://192.168.32.81:9200/megacorp/employee/_search/
POST
{
"query" : {
"filtered" : {
"filter" : {
"range" : {
"age" : { "gt" : 30 }
}
},
"query" : {
"match" : {
"last_name" : "smith"
}
}
}
}
}
返回:
{
"took": 29,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 1,
"max_score": 0.30685282,
"hits": [
{
"_index": "megacorp",
"_type": "employee",
"_id": "2",
"_score": 0.30685282,
"_source": {
"first_name": "Jane",
"last_name": "Smith",
"age": 32,
"about": "I like to collect rock albums",
"interests": [
"music"
]
}
}
]
}
}
<1> 这部分查询属于区间过滤器(range filter),它用于查找所有年龄大于30岁的数据
<2> 这部分查询与之前的 match 语句(query)一致。
全文搜索:
到目前为止搜索都很简单：搜索特定的名字,通过年龄筛选。让我们尝试一种更高级的搜索,
全文搜索---一种传统数据库很难实现的功能。
http://192.168.32.80:9200/megacorp/employee/_search/
POST
{
"query" : {
"match" : {
"about" : "rock climbing"
}
}
}
返回:
{
"took": 6,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 3,
"max_score": 0.16273327,
"hits": [
{
"_index": "megacorp",
"_type": "employee",
"_id": "1",
"_score": 0.16273327,
"_source": {
"first_name": "John",
"last_name": "Smith",
"age": 25,
"about": "I love to go rock climbing",
"interests": [
"sports"
,
"music"
]
}
}
,
{
"_index": "megacorp",
"_type": "employee",
"_id": "2",
"_score": 0.016878016,
"_source": {
"first_name": "Jane",
"last_name": "Smith",
"age": 32,
"about": "I like to collect rock albums",
"interests": [
"music"
]
}
}
,
{
"_index": "megacorp",
"_type": "employee",
"_id": "3",
"_score": 0.016878016,
"_source": {
"first_name": "Jane",
"last_name": "lee",
"age": 32,
"about": "I like to collect rock albums",
"interests": [
"music"
]
}
}
]
}
}默认情况下，Elasticsearch根据结果相关性评分来对结果集进行排序，所谓的「结果相关性
评分」就是文档与查询条件的匹配程度。很显然，排名第一的 John Smith 的 about 字段明确
的写到“rock climbing”。
但是为什么 Jane Smith 也会出现在结果里呢？原因是“rock”在她的 abuot 字段中被提及了。
因为只有“rock”被提及而“climbing”没有，所以她的 _score 要低于John。
这个例子很好的解释了Elasticsearch如何在各种文本字段中进行全文搜索，并且返回相关性
最大的结果集。相关性(relevance)的概念在Elasticsearch中非常重要，而这个概念在传统关
系型数据库中是不可想象的，因为传统数据库对记录的查询只有匹配或者不匹配
短语搜索:
目前我们可以在字段搜索单独的一个词,这挺好的,但是有时候你想要确切的匹配若干个单词或者短语(phrases).
例如我们想要查询同时包含"rock" 和"combing"（并且是相邻的）员工记录。
要做到这个,我们只要将match查询变更为match_phrase查询既可:
http://192.168.32.80:9200/megacorp/employee/_search/
POST
{
"query" : {
"match_phrase" : {
"about" : "rock climbing"
}
}
}
查询
{"query":{"match_all":{}}}
易读
结果转换器?
重复请求
显示选项?
{
"took": 15,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 1,
"max_score": 0.23013961,
"hits": [
{
"_index": "megacorp",
"_type": "employee",
"_id": "1",
"_score": 0.23013961,
"_source": {
"first_name": "John",
"last_name": "Smith",
"age": 25,
"about": "I love to go rock climbing",
"interests": [
"sports"
,
"music"
]
}
}
]
}
}
分析；
最后,我们还有一个需求需要完成:允许管理者在职员中进行分析。
Elasticsearch 有一个功能叫做聚合(aggregations),它允许你在数据上生成复杂的分析统计。它很像SQL中的
GROUP BY 但是功能更强大。
http://192.168.32.80:9200/megacorp/employee/_search/
POST
{
"aggs": {
"all_interests": {
"terms": { "field": "interests" }
}
}
{
"took": 8,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 3,
"max_score": 1,
"hits": [
{
"_index": "megacorp",
"_type": "employee",
"_id": "2",
"_score": 1,
"_source": {
"first_name": "Douglas",
"last_name": "Fir",
"age": 35,
"about": "I like to build cabinets",
"interests": [
"forestry"
]
}
}
,
{
"_index": "megacorp",
"_type": "employee",
"_id": "1",
"_score": 1,
"_source": {
"first_name": "John",
"last_name": "Smith",
"age": 25,
"about": "I love to go rock climbing",
"interests": [
"sports"
,
"music"
]
}
}
,
{
"_index": "megacorp",
"_type": "employee",
"_id": "3",
"_score": 1,
"_source": {
"first_name": "Jane",
"last_name": "lee",
"age": 32,
"about": "I like to collect rock albums",
"interests": [
"music"
]
}
}
]
},
"aggregations": {
"all_interests": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "music",
"doc_count": 2
}
,
{
"key": "forestry",
"doc_count": 1
}
,
{
"key": "sports",
"doc_count": 1
}
]
}
}
}
我们可以看到两个职员对音乐有兴趣，一个喜欢林学，一个喜欢运动。这些数据并没有被预
先计算好，它们是实时的从匹配查询语句的文档中动态计算生成的。如果我们想知道所有
姓"Smith"的人最大的共同点（兴趣爱好），我们只需要增加合适的语句既可：
/megacorp/employee/3
{
"first_name" : "Douglas",
"last_name" : "smith",
"age" : 35,
"about": "I like to build cabinets",
"interests": [ "music" ]
}
http://192.168.32.80:9200/megacorp/employee/_search/
POST
{
"query": {
"match": {
"last_name": "smith"
}
},
"aggs": {
"all_interests": {
"terms": {
"field": "interests"
}
}
}
}
http://192.168.32.80:9200/megacorp/employee/_search/
POST
{
"aggs" : {
"all_interests" : {
"terms" : { "field" : "interests" },
"aggs" : {
"avg_age" : {
"avg" : { "field" : "age" }
}
}
}
}
}
聚合也允许分级汇总。例如，让我们统计每种兴趣下职员的平均年龄：
分布式的特性；
Elasticsearch致力于隐藏分布式系统的复杂性。以下这些操作都是在底层自动完成的：
将你的文档分区到不同的容器或者分片(shards)中，它们可以存在于一个或多个节点
中。
将分片均匀的分配到各个节点，对索引和搜索做负载均衡。
冗余每一个分片，防止硬件故障造成的数据丢失。
将集群中任意一个节点上的请求路由到相应数据所在的节点。
无论是增加节点，还是移除节点，分片都可以做到无缝的扩展和迁移。
