ELK三：简单的增删改查

一、简单的增删改查

同时创建索引、类型、文档

PUT s18/doc/1
{
  "name": "jerry"
}

{
  "_index" : "s18",
  "_type" : "doc",
  "_id" : "1",
  "_version" : 1,
  "result" : "created",
  "_shards" : {
    "total" : 2,
    "successful" : 1,
    "failed" : 0
  },
  "_seq_no" : 0,
  "_primary_term" : 1
}

PUT s18/doc/2
{
  "name": "eva"
}

{
  "_index" : "s18",
  "_type" : "doc",
  "_id" : "2",
  "_version" : 1,
  "result" : "created",
  "_shards" : {
    "total" : 2,
    "successful" : 1,
    "failed" : 0
  },
  "_seq_no" : 1,
  "_primary_term" : 1
}

 查询文档：

根据文档id查询

GET s18/doc/1

 根据字段name查询

GET s18/doc/_search?q=name:eva

{
  "_index" : "s18",
  "_type" : "doc",
  "_id" : "2",
  "_version" : 1,
  "_seq_no" : 1,
  "_primary_term" : 1,
  "found" : true,
  "_source" : {
    "name" : "eva"
  }
}

 

查询所有文档

GET s18/doc/_search

{
  "took" : 5,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 2,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "s18",
        "_type" : "doc",
        "_id" : "2",
        "_score" : 1.0,
        "_source" : {
          "name" : "eva"
        }
      },
      {
        "_index" : "s18",
        "_type" : "doc",
        "_id" : "3",
        "_score" : 1.0,
        "_source" : {
          "name" : "laowang"
        }
      }
    ]
  }
}

 

删除文档：

DELETE s18/doc/1

{
  "_index" : "s18",
  "_type" : "doc",
  "_id" : "1",
  "_version" : 2,
  "result" : "deleted",
  "_shards" : {
    "total" : 2,
    "successful" : 1,
    "failed" : 0
  },
  "_seq_no" : 3,
  "_primary_term" : 1
}

 

删除索引：

DELETE s18

{
  "acknowledged" : true
}

 

再次删除此索引时，将抛出404异常

{
  "error" : {
    "root_cause" : [
      {
        "type" : "index_not_found_exception",
        "reason" : "no such index [s18]",
        "resource.type" : "index_or_alias",
        "resource.id" : "s18",
        "index_uuid" : "_na_",
        "index" : "s18"
      }
    ],
    "type" : "index_not_found_exception",
    "reason" : "no such index [s18]",
    "resource.type" : "index_or_alias",
    "resource.id" : "s18",
    "index_uuid" : "_na_",
    "index" : "s18"
  },
  "status" : 404
}

 

查询索引的映射类型

GET s18/_mapping

{
  "s18" : {
    "mappings" : {
      "properties" : {
        "name" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        }
      }
    }
  }
}

查看索引设置

GET s18/_settings

{
  "s18" : {
    "settings" : {
      "index" : {
        "creation_date" : "1559292464698",
        "number_of_shards" : "1",
        "number_of_replicas" : "1",
        "uuid" : "mEryI3-MRm6783OfHD1jug",
        "version" : {
          "created" : "7010199"
        },
        "provided_name" : "s18"
      }
    }
  }
}

 

查看索引所有的属性

GET s18

{
  "s18" : {
    "aliases" : { },
    "mappings" : {
      "properties" : {
        "name" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        }
      }
    },
    "settings" : {
      "index" : {
        "creation_date" : "1559292464698",
        "number_of_shards" : "1",
        "number_of_replicas" : "1",
        "uuid" : "mEryI3-MRm6783OfHD1jug",
        "version" : {
          "created" : "7010199"
        },
        "provided_name" : "s18"
      }
    }
  }
}

 

二、简单的增删改查

新增：

PUT s18/doc/1
{
  "name": "eva",
  "age": 23,
  "tags": "IT专业人士",
  "b": "20001215"
}
PUT s18/doc/2
{
  "name": "lily",
  "age": 29,
  "tags": "知情人士",
  "b": "19900105"
}
PUT s18/doc/3
{
  "name": "tom",
  "age": 35,
  "tags": "武林高手",
  "b": "19820515"
}
PUT s18/doc/4
{
  "name": "jacky",
  "age": 55,
  "tags": "闷骚",
  "b": "19800615"
}
PUT s18/doc/5
{
  "name": "ziven",
  "age": 16,
  "tags": "奶茶妹",
  "b": "19990515"
}

 

查询：

GET s18/doc/1
GET s18/doc/_search
GET s18/doc/_search?q=age:35

 

更新：

PUT s18/doc/5
{
  "tags": "....."
}

 

注意使用put更新时，必须要把所有字段都写上。

通常，使用POST .../_update进行修改。

POST s18/doc/4/_update
{
  "doc": {
    "tags": "!!!"
  }
}

 

删除：

删除某条记录： DELETE s18/doc/5

删除整个索引！： DELETE s18，慎用！

删除指定条件的文档： POST s18/doc/_delete_by_query?q=age:18

 

查询的两种方式

1. 字符串查询，如：s18/doc/_search?q=age:18
2. 结构化的查询，支持灵活而丰富的查询条件，如

   GET s18/doc/_search
   {
     "query": {
       "match": {
         "age": "35"
       }
     }
   }