ElasticSearch DSL使用详细介绍

删除某个索引下全部数据

POST operator_other_index/_delete_by_query?wait_for_completion=false{"query": {"match_all": {}}}

Ip查询

GET my-index/_search
{"query": {"term": {"ip_addr": "192.168.0.0/16"}}
}

针对上面的搜索，我稍微做一下解释：对于上面的 IPv4 的 IP 地址含有4个 bytes，而每个 byte 含有8个 digits。在上面的 /16 即表示前面的 16 位的 digits，也即 192.168。我们可以这么说任何一个 IP 地址位于 192.168.0.0 至 192.168.255.255 都在这个范围内

根据ip范围查询

GET operator_other_index/_search
{"query": {"range": {"start_ip": {"gte": "192.168.2.100","lte": "192.168.2.102"}}} ,"_source": ["start_ip","end_ip"]
}

获取重复数据

GET test.project/_search
{"size":0,"aggs":{"field":{"terms":{"field":"id.keyword","size":3000,"min_doc_count":1}}}
}

获取去重后数量

GET test.project/_search
{"size": 0, "aggs": {"count": {"cardinality": {"field": "id.keyword"}}}
}

模糊(Like)匹配单个字段

GET operator_other_index/_search
{"query":{"wildcard":{"certificate_code":"*824607*"}}
}

模糊(Like)匹配多个字段

GET operator_other_index/_search
{"query":{"bool":{"should":[{"wildcard":{"name":"*张*"}},{"wildcard":{"emergency_contact_name":"*张*"}},{"wildcard":{"certificate_type":"*张*"}}]}}
}

查询只返回某些指定字段

返回start_ip与end_ip字段

GET operator_other_index/_search
{"_source": ["start_ip","end_ip"]
}

多字段检索 multi_match

多字段检索 multi_match

multi_match 说明：https://www.elastic.co/guide/cn/elasticsearch/guide/current/multi-match-query.html

GET operator_other_index/_search
{"query": {"multi_match": {"query": "互联网数据中心编码","fields": ["data_center_service_code","computer_room_address","name","user_type","credit_code","address","emergency_contact_name","certificate_code","certificate_type","mobile_phone","phone"]}}
}

全字段检索

GET operator_other_index/_search
{"query": {"multi_match": {"query": "互联网数据中心编码"}}
}

全字段检索 - 设置完全匹配 minimum_should_match

参考：https://blog.csdn.net/qq_22985751/article/details/90704189

这里写100% 即是必须命中搜索词

GET operator_other_index/_search
{"query": {"multi_match": {"query": "申伟","fields": ["data_center_service_code","computer_room_address","name","user_type","credit_code","address","emergency_contact_name","certificate_code","certificate_type","mobile_phone","phone"],"minimum_should_match":"100%"}}
}

根据keyword字段进行group by

java代码：https://www.cnblogs.com/xionggeclub/p/7975982.html

GET log_lnk_data_flow_index/_search
{"size":0,"aggs": {     "group_by_keyword": {    "terms": { "field": "task_keyword" ,"size": 40000,"order": {"_count": "asc"}}  }}
}

根据ID更新数据

数据必须存在，如果之前不存在则会报错，报错内容如下

{"error" : {"root_cause" : [{"type" : "document_missing_exception","reason" : "[_doc][2]: document missing","index_uuid" : "KhAqJx5SR7uJIVZkdO0LIw","shard" : "0","index" : "index1"}],"type" : "document_missing_exception","reason" : "[_doc][2]: document missing","index_uuid" : "KhAqJx5SR7uJIVZkdO0LIw","shard" : "0","index" : "index1"},"status" : 404
}

POST /customer/_update/1?pretty
{"doc": { "name": "Jane Doe", "age": 20 }
}

Upsert操作

upsert 操作用于如果指定的 document 不存在，就执行 upsert 中的初始化操作；如果指定的 document 存在，就执行 doc 或者 script 指定的 partial update 操作

往index1所用中添加id为3的数据，如果id为3的数据不存在，则使用upsert下的数据修改或新增字段counter为1;如果存在则使用doc下的数据修改或新增字段name为new_name

POST index1/_update/3
{"doc" : {"name" : "new_name"},"upsert" : {"counter" : 1}
}

scripte demo

数据存在则将num字段值加1，数据不存在则添加upsert下的字段

POST indexname/_update/id
{"script" : "ctx._source.num+=1","upsert": {"field1":"value1","field2":"value2"}
}