Elasticsearch(二) 搜索

{
    "took": 48,		// 请求耗费毫秒
    "timed_out": false,		// 是否超时
    "_shards": {	// 参与分片的总数
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 3,		// 匹配到的文档总数
            "relation": "eq"
        },
        "max_score": 1.0,	// 与查询所匹配文档的_score的最大值
        "hits": [		// 文档
            {
                "_index": "megacorp",
                "_type": "employee",
                "_id": "1",
                "_score": 1.0,		// 与查询的匹配程度。这里没有指定查询，因此1是中性的_score
                "_source": {
                    "first_name": "John",
                    "last_name": "Smith",
                    "age": 25,
                    "about": "I love to go rock climbing",
                    "interests": ["sports", "music"]
                }
            },
            {
                "_index": "megacorp",
                "_type": "employee",
                "_id": "2",
                "_score": 1.0,
                "_source": {
                    "first_name": "Jane",
                    "last_name": "Smith",
                    "age": 32,
                    "about": "I like to collect rock albums",
                    "interests": ["music"]
                }
            },
            {
                "_index": "megacorp",
                "_type": "employee",
                "_id": "3",
                "_score": 1.0,
                "_source": {
                    "first_name": "Douglas",
                    "last_name": "Fir",
                    "age": 35,
                    "about": "I like to build cabinets",
                    "interests": ["forestry"]
                }
            }
        ]
    }
}

/_search			在所有的索引中搜索所有的类型
/test/_search		在test索引中搜索所有的类型
/a,b/_search		在a和b索引中搜索所有的文档
/a*,b*/_search		在任何以a或b开头的索引中搜索所有的类型
/test/user,employee/_search		在test索引中搜索user和employee类型	
/_all/user,employee/_search		在所有的索引中搜索user和employee类型	

假设在一个有5个主分片的索引中搜索：

当请求结果的第一页(结果从1 - 10)，每一个分片产生前10的结果，并且返回给协调节点，协调节点对50个结果排序得到全部结果的前10个

那么当请求第1000页的​结果，即从10001 - 10010。每个分片不得不产生前10010个结果，然后协调节点对全部50050个结果排序，最后会丢弃掉这些结果中的50040个结果

这可以看到在分布式系统中，对结果排序的成本随分页的深度成指数上升。这就是web搜索引擎对任何查询都不要返回超过1000个结果的原因

{
    "megacorp": {
        "mappings": {
            "properties": {
                "about": {
                    "type": "text",
                    "fields": {
                        "keyword": {
                            "type": "keyword",
                            "ignore_above": 256
                        }
                    }
                },
                "age": {
                    "type": "long"
                },
                "first_name": {
                    "type": "text",
                    "fields": {
                        "keyword": {
                            "type": "keyword",
                            "ignore_above": 256
                        }
                    }
                },
                "interests": {
                    "type": "text",
                    "fields": {
                        "keyword": {
                            "type": "keyword",
                            "ignore_above": 256
                        }
                    }
                },
                "last_name": {
                    "type": "text",
                    "fields": {
                        "keyword": {
                            "type": "keyword",
                            "ignore_above": 256
                        }
                    }
                }
            }
        }
    }
}

GET http://localhost:9200/_analyze
{
  "analyzer": "standard",
  "text": "Text to analyze"
}

返回：
{
    "tokens": [
        {
            "token": "text",
            "start_offset": 0,
            "end_offset": 4,
            "type": "<ALPHANUM>",
            "position": 0
        },
        {
            "token": "to",
            "start_offset": 5,
            "end_offset": 7,
            "type": "<ALPHANUM>",
            "position": 1
        },
        {
            "token": "analyze",
            "start_offset": 8,
            "end_offset": 15,
            "type": "<ALPHANUM>",
            "position": 2
        }
    ]
}

PUT /my_index
{
    "settings": {
        "number_of_shards":   1,	// 每个索引的主分片数，默认值是5
        "number_of_replicas": 0,	// 每个主分片的副本数，默认值是1
		"analysis": {			// 一个分析器就是在一个包里面组合了三种函数的一个包装器，三种函数按照顺序被执行
								// 字符过滤器、分词器(必须且唯一)、词单元过滤器
            "analyzer": {
                "my_analyzer": {	// my_analyzer分析器非全局，只存在于my_index索引中		
                    "type":      "custom",
					"char_filter": [ "html_strip", "&_to_and" ],	// html清除 + 自定义映射字符过滤器
					"tokenizer": "standard",	// 使用标准分词器分词
					"filter": [ "lowercase" ]	// 使用小写词过滤器
                    "stopwords": "_spanish_"	// 使用一个预定义的西班牙语停用词列表
                }
            },
			"char_filter": {
				"&_to_and": {
					"type":     "mapping",
					"mappings": [ "&=> and " ]	// 把 & 替换为 and
				}
			},
			"tokenizer": { ... custom tokenizers ... },
			"filter": { ... custom token filters ... }
        }
    },
    "mappings": {
        "type_one": { ... any mappings ... },
        "type_two": { ... any mappings ... },
        ...
    }
}

PUT /my_index/_mapping/my_type
{
    "properties": {
        "title": {
            "type":      "string",
            "analyzer":  "my_analyzer"
        }
    }
}

DELETE /my_index
DELETE /my_index1,my_index2
DELETE /index_*
DELETE /_all

PUT /my_index_v1 {...}
// 别名my_index指向my_index_v1索引
PUT /my_index_v1/_alias/my_index 

// 查询这个别名指向哪一个索引
GET /*/_alias/my_index
// 查询哪些别名指向这个索引
GET /my_index_v1/_alias/*

// 为了重新索引数据，用新映射创建索引my_index_v2
PUT /my_index_v2
{
    "mappings": {
        "my_type": {
            "properties": {
                "tags": {
                    "type":   "string",
                    "index":  "not_analyzed"
                }
            }
        }
    }
}

// 用scroll从旧的索引检索批量文档，用bulk API把文档从my_index_v1索引到my_index_v2
GET /old_index/_search?scroll=1m
{
    "query": {
        "range": {
            "date": {
                "gte":  "2021-01-01",
                "lt":   "2021-12-01"
            }
        }
    },
    "sort": ["_doc"],
    "size":  1000
}
// 或直接使用Reindex API对文档重建索引
POST _reindex
{
  "source": {
    "index": "my_index_v1"
  },
  "dest": {
    "index": "my_index_v2"
  }
}

// 一个别名可以指向多个索引，所以在添加别名到新索引的同时，必须从旧的索引中删除它
POST /_aliases	// 原子化操作
{
    "actions": [
        { "remove": { "index": "my_index_v1", "alias": "my_index" }},
        { "add":    { "index": "my_index_v2", "alias": "my_index" }}
    ]
}

{
    "bool": {
        "must": { "match":   { "email": "business opportunity" }},
		"filter":   { "range": { "age" : { "gt" : 30 }} },
        "should": [
            { "match":       { "starred": true }},
            { "bool": {
                "must":      { "match": { "folder": "inbox" }},
                "must_not":  { "match": { "spam": true }}
            }}
        ],
        "minimum_should_match": 1
    }
}

GET http://localhost:9200/megacorp/_validate/query
{
   "query": {
      "match" : {
         "last_name" : "really powerful"
      }
   }
}
验证查询是否合法：
{
    "_shards": {
        "total": 1,
        "successful": 1,
        "failed": 0
    },
    "valid": true
}
如果将match和last_name的位置互换，则会返回"valid": false。可以使用?explain来查看原因
GET http://localhost:9200/megacorp/_validate/query?explain
{
    "valid": false,
    "error": "ParsingException[unknown query [last_name]]; nested: NamedObjectNotFoundException[[3:21] unknown field [last_name]];; org.elasticsearch.common.xcontent.NamedObjectNotFoundException: [3:21] unknown field [last_name]"
}
换回来后再请求就返回：
{
    "_shards": {
        "total": 1,
        "successful": 1,
        "failed": 0
    },
    "valid": true,
    "explanations": [
        {
            "index": "megacorp",
            "valid": true,
            "explanation": "+(last_name:really last_name:powerful) #*:*"
        }
    ]
}

{
    "query" : {
        "bool" : {
            "must":    { "match": { "tweet": "manage text search" }},
            "filter" : { "term" : { "user_id" : 2 }}
        }
    },
    "sort": [
        { "createTime": { "order": "desc" }},
        { "_score": 	{ "order": "desc" }}
    ]
}

GET /test/products/_search
{
    "query" : {
        "constant_score" : { 
            "filter" : {
                "term" : { 
                    "price" : 20
                }
            }
        }
    }
}

{
    "query": {
        "match": {
            "title": {      
                "query":    "quick brown dog",
                "operator": "and"
				// "minimum_should_match": "75%" 最小匹配参数，指定必须匹配的词项数用来表示一个文档是否相关
            }
        }
    }
}

{
  "query": {
    "bool": {
      "must":     { "match": { "title": "quick" }},
      "must_not": { "match": { "title": "lazy"  }},
      "should": [
                  { "match": { "title": "brown" }},
                  { "match": { "title": "dog"   }}
      ],
	  "minimum_should_match": 2	 // 控制需要匹配的should语句的数量，同样可以是数字或百分比
    }
  }
}

{
    "query": {
        "bool": {
            "must": {
                "match": {  
                    "content": {
                        "query":    "full text search",	// 默认1
                        "operator": "and"
                    }
                }
            },
            "should": [
                { "match": {
                    "content": {
                        "query": "Elasticsearch",
                        "boost": 3 		// 权重3
                    }
                }},
                { "match": {
                    "content": {
                        "query": "Lucene",
                        "boost": 2 		// 权重2
                    }
                }}
            ]
        }
    }
}

{
    "query": {
        "match_phrase": {
            "title": "quick brown fox"
        }
    }
}
等价于
"match": {
    "title": {
        "query": "quick brown fox",
        "type":  "phrase"
    }
}

{
    "query": {
        "match_phrase": {
            "title": {
            	"query": "quick brown fox",
            	"slop":  2
            }
        }
    }
}

// 文档字段
"names": [ "John Abraham", "Lincoln Smith"]
// 查询
"query": {
	"match_phrase": {
		"names": "Abraham Lincoln"
	}
}
将会查询到文档，因为这2个正好是相邻的

DELETE /my_index/groups/
PUT /my_index/_mapping/groups 
{
    "properties": {
        "names": {
            "type":                "string",
            "position_increment_gap": 100
        }
    }
}
这样当我们查询数组时，里面的元素间距将变为100，除非定义100的slop来查询，否则不会查询到

{
  "query": {
    "bool": {
      "must": {
        "match": { 
          "title": {
            "query":                "quick brown fox",
            "minimum_should_match": "30%"
          }
        }
      },
      "should": {
        "match_phrase": { 
          "title": {
            "query": "quick brown fox",
            "slop":  50
          }
        }
      }
    }
  }
}

{
    "query": {
        "prefix": {
            "postcode": "W1"
        }
    }
}

"query": {
	"wildcard": {
		"postcode": "W?F*HW" 
	}
}

"query": {
	"regexp": {
		"postcode": "W[0-9].+" 
	}
}

{
    "size" : 0,		// 不关心搜索结果的具体内容，将返回记录数设置为0来提高查询速度
    "aggs" : { 
        "popular_colors" : { 	// 聚合名称
            "terms" : {
              "field" : "color"
            }
        }
    }
}

// 返回
{
...
   "hits": {
      "hits": [] 	// size为0，因此没有结果返回
   },
   "aggregations": {
      "popular_colors": { 	// 标签作为aggregations一部分返回
         "buckets": [
            {
               "key": "red", 	// 颜色
               "doc_count": 4 	// 包含该词项的文档数量
            },
            {
               "key": "blue",
               "doc_count": 2
            },
            {
               "key": "green",
               "doc_count": 2
            }
         ]
      }
   }
}

{
   "size" : 0,
   "aggs": {
      "colors": {
         "terms": {
            "field": "color"
         },
         "aggs": { 	// 新的聚合层将avg度量嵌套置于terms桶内，就为每个颜色生成了平均价格
            "avg_price": { 
               "avg": {
                  "field": "price" 
               }
            }
         }
      }
   }
}

// 返回
"aggregations": {
  "colors": {
	 "buckets": [
		{
		   "key": "red",
		   "doc_count": 4,
		   "avg_price": { 
			  "value": 32500
		   }
		},
	  ...
	 ]
  }
}		  

{
   "size" : 0,
   "aggs": {
      "colors": {
         "terms": {
            "field": "color"
         },
         "aggs": {
            "avg_price": { "avg": { "field": "price" }
            },
            "make" : {
                "terms" : {		// terms桶，为每个汽车制造商生成唯一的桶
                    "field" : "make"
                },
                "aggs" : { 
                    "min_price" : { "min": { "field": "price"} }, 
                    "max_price" : { "max": { "field": "price"} } 
                }
            }
         }
      }
   }
}

{
    "size" : 0,
    "query" : {
        "match" : {
            "make" : "ford"
        }
    },
    "aggs" : {
        "single_avg_price": {	// 在范围内聚合
            "avg" : { "field" : "price" } 
        },
        "all": {
            "global" : {}, 		// 全局桶没有参数
            "aggs" : {
                "avg_price": {	// 针对所有文档聚合
                    "avg" : { "field" : "price" } 
                }

            }
        }
    }
}

{
    "size" : 0,
    "query" : {
        "constant_score": {
            "filter": {
                "range": {
                    "price": {
                        "gte": 10000
                    }
                }
            }
        }
    },
    "aggs" : {
        "single_avg_price": {
            "avg" : { "field" : "price" }
        }
    }
}

{
   "size" : 0,
   "query":{
      "match": {
         "make": "ford"
      }
   },
   "aggs":{
      "recent_sales": {
         "filter": { 	// 使用 过滤桶 在查询范围基础上应用过滤器
            "range": {
               "sold": {
                  "from": "now-1M"
               }
            }
         },
         "aggs": {
            "average_price":{
               "avg": {	// 	avg度量只会对ford和上个月售出的文档计算平均售价
                  "field": "price" 
               }
            }
         }
      }
   }
}

{
    "size" : 0,
    "query": {
        "match": {
            "make": "ford"	// 查询品牌
        }
    },
    "post_filter": {    // 按照颜色过滤
        "term" : {
            "color" : "green"
        }
    },
    "aggs" : {
        "all_colors": {
            "terms" : { "field" : "color" }
        }
    }
}

{
    "size" : 0,
    "aggs" : {
        "colors" : {
            "terms" : {
              "field" : "color",
              "order": {
                "_count" : "asc" 
              }
            }
        }
    }
}

{
    "size" : 0,
    "aggs" : {
        "colors" : {
            "terms" : {
              "field" : "color",
              "order": {	// 桶按照计算平均值的升序排序
			  // 如果想使用多值度量进行排序，只需以度量为关键词使用点式路径，例如stats.variance
                "avg_price" : "asc" 
              }
            },
            "aggs": {
                "avg_price": {	// 计算每个桶的平均售价
                    "avg": {"field": "price"} 
                }
            }
        }
    }
}

{
    "size" : 0,
    "aggs" : {
        "colors" : {
            "histogram" : {
              "field" : "price",
              "interval": 20000,
              "order": {	// 按照嵌套度量的方差对桶的直方图进行排序
                "red_green_cars>stats.variance" : "asc" 
              }
            },
            "aggs": {
                "red_green_cars": {	// 使用单值过滤器filter，可以使用嵌套排序
                    "filter": { "terms": {"color": ["red", "green"]}}, 
                    "aggs": {	// 按照这个统计结果排序
                        "stats": {"extended_stats": {"field" : "price"}} 
                    }
                }
            }
        }
    }
}