别只会搜日志了，求你懂点原理吧

docker pull elasticsearch:7.4.2
1.

配置映射文件夹
mkdir -p /mydata/elasticsearch/config

配置映射文件夹
mkdir -p /mydata/elasticsearch/data

设置文件夹权限任何用户可读可写
chmod 777 /mydata/elasticsearch -R

配置 http.host
echo "http.host: 0.0.0.0" >> /mydata/elasticsearch/config/elasticsearch.yml
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.

docker run --name elasticsearch -p 9200:9200 -p 9300:9300 \
-e "discovery.type"="single-node" \
-e ES_JAVA_OPTS="-Xms64m -Xmx128m" \
-v /mydata/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
-v /mydata/elasticsearch/data:/usr/share/elasticsearch/data \
-v /mydata/elasticsearch/plugins:/usr/share/elasticsearch/plugins \
-d elasticsearch:7.4.2
1.
2.
3.
4.
5.
6.
7.

{
  "name" : "8448ec5f3312",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "xC72O3nKSjWavYZ-EPt9Gw",
  "version" : {
    "number" : "7.4.2",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "2f90bbf7b93631e52bafb59b3b049cb44ec25e96",
    "build_date" : "2019-10-28T20:40:44.881551Z",
    "build_snapshot" : false,
    "lucene_version" : "8.2.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.

127.0.0.1 62 90 0 0.06 0.10 0.05 dilm * 8448ec5f3312
1.

docker pull kibana:7.4.2

docker run --name kibana -e ELASTICSEARCH_HOSTS=http://192.168.56.10:9200 -p 5601:5601 -d kibana:7.4.2
1.
2.
3.

GET /_cat/nodes: 查看所有节点
GET /_cat/health: 查看 es 健康状况
GET /_cat/master: 查看主节点
GET /_cat/indices: 查看所有索引

查询汇总：
/_cat/allocation
/_cat/shards
/_cat/shards/{index}
/_cat/master
/_cat/nodes
/_cat/tasks
/_cat/indices
/_cat/indices/{index}
/_cat/segments
/_cat/segments/{index}
/_cat/count
/_cat/count/{index}
/_cat/recovery
/_cat/recovery/{index}
/_cat/health
/_cat/pending_tasks
/_cat/aliases
/_cat/aliases/{alias}
/_cat/thread_pool
/_cat/thread_pool/{thread_pools}
/_cat/plugins
/_cat/fielddata
/_cat/fielddata/{fields}
/_cat/nodeattrs
/_cat/repositories
/_cat/snapshots/{repository}
/_cat/templates
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.

PUT member/external/1

{
"name":"jay huang"
}
1.
2.
3.
4.
5.

{
    "_index": "member", //在哪个索引
    "_type": "external",//在那个类型
    "_id": "2",//记录 id
    "_version": 7,//版本号
    "result": "updated",//操作类型
    "_shards": {
        "total": 2,
        "successful": 1,
        "failed": 0
    },
    "_seq_no": 9,
    "_primary_term": 1
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.

请求：http://192.168.56.10:9200/member/external/2

Reposne:
{
    "_index": "member",   //在哪个索引
    "_type": "external",  //在那个类型
    "_id": "2",           //记录 id
    "_version": 7,        //版本号
    "_seq_no": 9,         //并发控制字段，每次更新就会+1，用来做乐观锁
    "_primary_term": 1,   //同上，主分片重新分配，如重启，就会变化
    "found": true,
    "_source": { //真正的内容
        "name": "jay huang"
 }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.

请求更新记录 2: http://192.168.56.10:9200/member/external/2?if_seq_no=9&&if_primary_term=1
返回结果：
{
    "_index": "member",
    "_type": "external",
    "_id": "2",
    "_version": 9,
    "result": "updated",
    "_shards": {
        "total": 2,
        "successful": 1,
        "failed": 0
    },
    "_seq_no": 11,
    "_primary_term": 1
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.

{
    "error": {
        "root_cause": [
 {
                "type": "version_conflict_engine_exception",
                "reason": "[2]: version conflict, required seqNo [10], primary term [1]. current document has seqNo [11] and primary term [1]",
                "index_uuid": "CX6uwPBKRByWpuym9rMuxQ",
                "shard": "0",
                "index": "member"
 }
        ],
        "type": "version_conflict_engine_exception",
        "reason": "[2]: version conflict, required seqNo [10], primary term [1]. current document has seqNo [11] and primary term [1]",
        "index_uuid": "CX6uwPBKRByWpuym9rMuxQ",
        "shard": "0",
        "index": "member"
    },
    "status": 409
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.

POST 请求：http://192.168.56.10:9200/member/external/2/_update
{
    "doc":{
        "name":"jay huang"
 }
}
响应：
{
    "_index": "member",
    "_type": "external",
    "_id": "2",
    "_version": 12,
    "result": "noop",
    "_shards": {
        "total": 0,
        "successful": 0,
        "failed": 0
    },
    "_seq_no": 14,
    "_primary_term": 1
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.

http://192.168.56.10:9200/member/external/2/_update
request:
{
    "doc":{
        "name":"jay huang",
        "age": 18
 }
}
response:
{
    "_index": "member",
    "_type": "external",
    "_id": "2",
    "_version": 13,
    "result": "updated",
    "_shards": {
        "total": 2,
        "successful": 1,
        "failed": 0
    },
    "_seq_no": 15,
    "_primary_term": 1
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.

DELETE 请求：http://192.168.56.10:9200/member/external/2
response:
{
    "_index": "member",
    "_type": "external",
    "_id": "2",
    "_version": 2,
    "result": "deleted",
    "_shards": {
        "total": 2,
        "successful": 1,
        "failed": 0
    },
    "_seq_no": 1,
    "_primary_term": 1
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.

DELETE 请求：http://192.168.56.10:9200/member
repsonse:
{
    "acknowledged": true
}
1.
2.
3.
4.
5.

POST /member/external/_bulk
{"index":{"_id":"1"}}
{"name":"Jay Huang"}
{"index":{"_id":"2"}}
{"name":"Jackson Huang"}
1.
2.
3.
4.
5.

https://raw.githubusercontent.com/elastic/elasticsearch/master/docs/src/test/resources/accounts.json
1.

POST /bank/account/_bulk
{"index":{"_id":"1"}}
{"account_number":1,"balance":39225,"firstname":"Amber","lastname":"Duke","age":32,"gender":"M","address":"880 Holmes Lane","employer":"Pyrami","email":"amberduke@pyrami.com","city":"Brogan","state":"IL"}
{"index":{"_id":"6"}}
......
1.
2.
3.
4.
5.

GET bank/_search?q=*&sort=account_number: asc
1.

took – ES 执行搜索的时间 ( 毫秒 )
timed_out – ES 是否超时
_shards – 有多少个分片被搜索了，以及统计了成功/失败/跳过的搜索的分片
max_score – 最高得分
hits.total.value - 命中多少条记录
hits.sort - 结果的排序 key 键，没有则按 score 排序
hits._score - 相关性得分
参考文档：
https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-search.html
1.
2.
3.
4.
5.
6.
7.
8.
9.

GET bank/_search
{
  "query":{"match_all": {}},
  "sort": [
    {"account_number": "asc" }
 ]
}
1.
2.
3.
4.
5.
6.
7.

GET bank/_search
{
  "query": {
    "match_all": {}
  },
  "sort": [
 {
      "balance": {
        "order": "desc"
 }
 }
  ],
  "from": 10,
  "size": 10,
  "_source": ["balance", "firstname"]
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.

GET bank/_search
{
  "query": {
    "match": {"account_number": "30"}
 }
}
1.
2.
3.
4.
5.
6.

GET bank/_search
{
  "query": {
    "match": {
      "address": "mill road"
 }
 }
}
1.
2.
3.
4.
5.
6.
7.
8.

GET bank/_search
{
  "query": {
    "match_phrase": {
      "address": "mill road"
 }
 }
}
1.
2.
3.
4.
5.
6.
7.
8.

GET bank/_search
{
  "query": {
    "multi_match": {
      "query": "mill land",
      "fields": [
        "state",
        "address"
 ]
 }
 }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.

GET bank/_search
{
  "query": {
    "bool": {
      "must": [
       {
          "match": {
            "address": "mill"
          }
       },
       {
          "match": {
            "gender": "M"
          }
      }
     ],
      "must_not": [
      {
          "match": {
            "age": "28"
      }
     }],
      "should": [
      {
          "match": {
            "firstname": "Winnie"
          }
      }]
   }
 }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.

GET bank/_search
{
  "query": {
    "bool": {
      "filter": [
       {
          "range": {
            "age": {
              "gte":18,
              "lte":40
            }
         }
      }]
   }
 }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.

非 text 字段精确匹配
GET bank/_search
{
  "query": {
    "term": {
      "age": "20"
    }
  }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.

"aggregations" : {
    "<聚合名称 1>" : {
        "<聚合类型>" : {
            <聚合体内容>
        }
        [,"元数据" : {  [<meta_data_body>] }]?
        [,"aggregations" : { [<sub_aggregation>]+ }]?
    }
    ["聚合名称 2>" : { ... }]*
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.

GET bank/_search
{
  "query": {
    "match": {
      "address": "mill"
 }
  },
  "aggs": {
    "ageAggr": {
      "terms": {
        "field": "age",
        "size": 10
 }
    },
    "ageAvg": {
      "avg": {
        "field": "age"
 }
    },
    "balanceAvg": {
      "avg": {
        "field": "balance"
   }
  }
 }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.

GET bank/_search
{
  "query": {
    "match": {
      "address": "mill"
 }
  },
  "aggs": {
    "ageAggr": {
      "terms": {
        "field": "age",
        "size": 10
    }
   }
  },
  "size": 0
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.

GET bank/_search
{
  "query": {
    "match_all": {
 }
  },
  "aggs": {
    "ageAggr": {
      "terms": {
        "field": "age",
        "size": 10
      },
      "aggs": {
        "genderAggr": {
          "terms": {
            "field": "gender.keyword",
            "size": 10
          },
          "aggs": {
            "balanceAvg": {
              "avg": {
                "field": "balance"
            }
         }
       }
      }
     }
   }
  },
  "size": 0
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.

GET /my-index/_mapping
返回结果：
{
  "my-index" : {
    "mappings" : {
      "properties" : {
        "age" : {
          "type" : "integer"
        },
        "email" : {
          "type" : "keyword"
        },
        "employee-id" : {
          "type" : "keyword",
          "index" : false
        },
        "name" : {
          "type" : "text"
      }
    }
  }
 }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.

PUT /my-index
{
  "mappings": {
    "properties": {
      "age": { "type": "integer" },
      "email": { "type": "keyword"  },
      "name": { "type": "text" }
    }
 }
返回结果：
{
  "acknowledged" : true,
  "shards_acknowledged" : true,
  "index" : "my-index"
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.

PUT /my-index/_mapping
{
  "properties": {
    "employee-id": {
      "type": "keyword",
      "index": false
   }
 }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.

POST _reindex
{
  "source": {
    "index": "twitter"
  },
  "dest": {
    "index": "new_twitter"
 }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.

POST _analyze
{
  "analyzer": "standard",
  "text": "Do you know why I want to study ELK? 2 3 33..."
}
1.
2.
3.
4.
5.

do, you, know, why, i, want, to, study, elk, 2,3,33
1.

POST _analyze
{
  "analyzer": "standard",
  "text": "悟空聊架构"
}
1.
2.
3.
4.
5.

https://github.com/medcl/elasticsearch-analysis-ik/releases
1.

http://192.168.56.10:9200/
{
  "name" : "8448ec5f3312",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "xC72O3nKSjWavYZ-EPt9Gw",
  "version" : {
    "number" : "7.4.2",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "2f90bbf7b93631e52bafb59b3b049cb44ec25e96",
    "build_date" : "2019-10-28T20:40:44.881551Z",
    "build_snapshot" : false,
    "lucene_version" : "8.2.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.

docker exec -it <容器 id> /bin/bash
1.

wget https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v7.4.2/elasticsearch-analysis-ik-7.4.2.zip
1.

unzip 压缩包
1.

rm -rf *.zip
1.

cd /mydata/elasticsearch/plugins
1.

wget https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v7.4.2/elasticsearch-analysis-ik-7.4.2.zip
1.

unzip 压缩包
1.

rm -rf *.zip
1.

apt install unzip
1.

unzip ELK-IKv7.4.2.zip -d ./ik
1.

chmod -R 777 ik/
1.

rm ELK-IKv7.4.2.zip
1.

docker exec -it <容器 id> /bin/bash
1.

elasticsearch-plugin list
1.

ik
1.

exit
docker restart elasticsearch
1.
2.

POST _analyze
{
  "analyzer": "ik_smart",
  "text": "一颗小星星"
}
1.
2.
3.
4.
5.

POST _analyze
{
  "analyzer": "ik_max_word",
  "text": "一颗小星星"
}
1.
2.
3.
4.
5.

/usr/share/elasticsearch/plugins/ik/config/IKAnalyzer.cfg.xml。
1.

/mydata/elasticsearch/plugins/ik/config/IKAnalyzer.cfg.xml
1.

vim /mydata/elasticsearch/plugins/ik/config/IKAnalyzer.cfg.xml
1.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
    <comment>IK Analyzer 扩展配置</comment>
    <!--用户可以在这里配置自己的扩展字典 -->
    <entry key="ext_dict">custom/mydict.dic;custom/single_word_low_freq.dic</entry>
     <!--用户可以在这里配置自己的扩展停止词字典-->
    <entry key="ext_stopwords">custom/ext_stopword.dic</entry>
     <!--用户可以在这里配置远程扩展字典 -->
    <entry key="remote_ext_dict">location</entry>
     <!--用户可以在这里配置远程扩展停止词字典-->
    <entry key="remote_ext_stopwords">http://xxx.com/xxx.dic</entry>
</properties>
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.

docker run -p 80:80 --name nginx -d nginx:1.10
1.

cd /mydata
docker container cp nginx:/etc/nginx ./conf
1.
2.

mkdir nginx
1.

mv conf nginx/
1.

docker stop nginx
docker rm <容器 id>
1.
2.

docker run -p 80:80 --name nginx \
-v /mydata/nginx/html:/usr/share/nginx/html \
-v /mydata/nginx/logs:/var/log/nginx \
-v /mydata/nginx/conf:/etc/nginx \
-d nginx:1.10
1.
2.
3.
4.
5.

192.168.56.10
1.

cd /mydata/nginx/html
vim index.html
hello passjava
1.
2.
3.

cd /mydata/nginx/html
mkdir ik
cd ik
vim ik.txt
1.
2.
3.
4.

http://192.168.56.10/ik/ik.txt
1.

cd /mydata/elasticsearch/plugins/ik/config
vim IKAnalyzer.cfg.xml
1.
2.

docker restart elasticsearch
docker update elasticsearch --restart=always
1.
2.