删除某个索引下全部数据
POST operator_other_index/_delete_by_query?wait_for_completion=false
{
"query": {
"match_all": {}
}
}
Ip查询
GET my-index/_search
{
"query": {
"term": {
"ip_addr": "192.168.0.0/16"
}
}
}
针对上面的搜索，我稍微做一下解释：对于上面的 IPv4 的 IP 地址含有4个 bytes，而每个 byte 含有8个 digits。在上面的 /16 即表示前面的 16 位的 digits，也即 192.168。我们可以这么说任何一个 IP 地址位于 192.168.0.0 至 192.168.255.255 都在这个范围内
根据ip范围查询
GET operator_other_index/_search
{
"query": {
"range": {
"start_ip": {
"gte": "192.168.2.100",
"lte": "192.168.2.102"
}
}
} ,"_source": [
"start_ip",
"end_ip"
]
}
获取重复数据
GET test.project/_search
{
"size":0,
"aggs":{
"field":{
"terms":{
"field":"id.keyword",
"size":3000,
"min_doc_count":1
}
}
}
}
获取去重后数量
GET test.project/_search
{
"size": 0,
"aggs": {
"count": {
"cardinality": {
"field": "id.keyword"
}
}
}
}
模糊(Like)匹配单个字段
GET operator_other_index/_search
{
"query":{
"wildcard":{
"certificate_code":"*824607*"
}
}
}
模糊(Like)匹配多个字段
GET operator_other_index/_search
{
"query":{
"bool":{
"should":[
{
"wildcard":{
"name":"*张*"
}
},
{
"wildcard":{
"emergency_contact_name":"*张*"
}
},
{
"wildcard":{
"certificate_type":"*张*"
}
}
]
}
}
}
查询只返回某些指定字段
返回start_ip与end_ip字段
GET operator_other_index/_search
{
"_source": [
"start_ip",
"end_ip"
]
}
多字段检索 multi_match
多字段检索 multi_match
multi_match 说明：https://www.elastic.co/guide/cn/elasticsearch/guide/current/multi-match-query.html
GET operator_other_index/_search
{
"query": {
"multi_match": {
"query": "互联网数据中心编码",
"fields": ["data_center_service_code","computer_room_address","name","user_type","credit_code","address","emergency_contact_name","certificate_code","certificate_type","mobile_phone","phone"]
}
}
}
全字段检索
GET operator_other_index/_search
{
"query": {
"multi_match": {
"query": "互联网数据中心编码"
}
}
}
全字段检索 - 设置完全匹配 minimum_should_match
参考：https://blog.csdn.net/qq_22985751/article/details/90704189
这里写100% 即是必须命中搜索词
GET operator_other_index/_search
{
"query": {
"multi_match": {
"query": "申伟",
"fields": ["data_center_service_code","computer_room_address","name","user_type","credit_code","address","emergency_contact_name","certificate_code","certificate_type","mobile_phone","phone"],
"minimum_should_match":"100%"
}
}
}
根据keyword字段进行group by
java代码：https://www.cnblogs.com/xionggeclub/p/7975982.html
GET log_lnk_data_flow_index/_search
{
"size":0,
"aggs": {
"group_by_keyword": {
"terms": {
"field": "task_keyword"
,"size": 40000
,"order": {
"_count": "asc"
}
}
}
}
}
根据ID更新数据
数据必须存在，如果之前不存在则会报错，报错内容如下
{ "error" : { "root_cause" : [ { "type" : "document_missing_exception", "reason" : "[_doc][2]: document missing", "index_uuid" : "KhAqJx5SR7uJIVZkdO0LIw", "shard" : "0", "index" : "index1" } ], "type" : "document_missing_exception", "reason" : "[_doc][2]: document missing", "index_uuid" : "KhAqJx5SR7uJIVZkdO0LIw", "shard" : "0", "index" : "index1" }, "status" : 404 }
POST /customer/_update/1?pretty
{
"doc": {
"name": "Jane Doe", "age": 20 }
}
Upsert操作
upsert 操作用于如果指定的 document 不存在，就执行 upsert 中的初始化操作；如果指定的 document 存在，就执行 doc 或者 script 指定的 partial update 操作
往index1所用中添加id为3的数据，如果id为3的数据不存在，则使用upsert下的数据修改或新增字段counter为1;如果存在则使用doc下的数据修改或新增字段name为new_name
POST index1/_update/3
{
"doc" : {
"name" : "new_name"
},
"upsert" : {
"counter" : 1
}
}
scripte demo
数据存在则将num字段值加1，数据不存在则添加upsert下的字段
POST indexname/_update/id
{
"script" : "ctx._source.num+=1",
"upsert": {
"field1":"value1",
"field2":"value2"
}
}
转载：https://blog.csdn.net/zhangshenghang/article/details/129165628
查看评论