使用kibana操作elasticsearch7.x 教程

Posted tj21

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了使用kibana操作elasticsearch7.x 教程相关的知识,希望对你有一定的参考价值。

由于elasticsearch7.x取消了type(类型的概念)对应数据库表的概念

kibana的配置以及安装地址:https://www.cnblogs.com/TJ21/p/12642219.html

添加一个索引

PUT 索引名
{
"settings": {
"number_of_shards": 1,
"number_of_replicas": 0
}
}

创建映射字段

analyzer:分词器    下载地址:https://github.com/medcl/elasticsearch-analysis-ik

PUT /索引名/_mapping
{
"properties": {
"title":{
"type": "text",
"analyzer": "ik_max_word"
},
"images":{
"type": "keyword",
"index": false
},
"price":{
"type": "float"
}
}
}

查看映射关系

GET /索引名/_mapping

新增数据

随机生成id

POST /索引库名/_doc
{
"title":"大米手机",
"images":"http://image.leyou.com/12479122.jpg",
"price":2899.00
}

自定义id   

自定义id值不能重复,否则数据将会被覆盖

POST /索引库名/_doc/自定义id值
{
    "title":"超米手机",
    "images":"http://image.leyou.com/12479122.jpg",
    "price":3699.00,
    "Saleable":true
}

 

修改数据,

将上面自定义id的请求方式修改

PUT /索引库/_doc/id值
{
"title":"超大米手机",
"images":"http://image.leyou.com/12479122.jpg",
"price":3899.00,
"stock": 100,
"saleable":true
}

删除数据

DELETE /索引库名/_doc/id值

查询

查询所有

GET /索引库名/_search 
{
"query": {
"match_all": {}
}
}

响应内容:

技术图片
{
  "took" : 0,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 6,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "goods",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 1.0,
        "_source" : {
          "title" : "小米手机",
          "images" : "http://image.leyou.com/12479122.jpg",
          "price" : 2699.0,
          "Saleable" : true
        }
      },
      {
        "_index" : "goods",
        "_type" : "_doc",
        "_id" : "mmHtSnEBVcsVh4Caiarl",
        "_score" : 1.0,
        "_source" : {
          "title" : "大米手机",
          "images" : "http://image.leyou.com/12479122.jpg",
          "price" : 2899.0
        }
      },
      {
        "_index" : "goods",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 1.0,
        "_source" : {
          "title" : "超米手机",
          "images" : "http://image.leyou.com/12479122.jpg",
          "price" : 3699.0,
          "Saleable" : true
        }
      },
      {
        "_index" : "goods",
        "_type" : "_doc",
        "_id" : "3",
        "_score" : 1.0,
        "_source" : {
          "title" : "小米电视4A",
          "images" : "http://image.leyou.com/12479122.jpg",
          "price" : 4699.0,
          "Saleable" : true
        }
      },
      {
        "_index" : "goods",
        "_type" : "_doc",
        "_id" : "4",
        "_score" : 1.0,
        "_source" : {
          "title" : "华为手机",
          "subTitle" : "小米",
          "images" : "http://image.leyou.com/12479122.jpg",
          "price" : 4699.0
        }
      },
      {
        "_index" : "goods",
        "_type" : "_doc",
        "_id" : "5",
        "_score" : 1.0,
        "_source" : {
          "title" : "oppo",
          "subTitle" : "小米",
          "images" : "http://image.leyou.com/12479122.jpg",
          "price" : 4899.0
        }
      }
    ]
  }
}
View Code

 

字段解析:

技术图片
- took:查询花费时间,单位是毫秒
- time_out:是否超时
- _shards:分片信息
- hits:搜索结果总览对象
  - total:搜索到的总条数
  - max_score:所有结果中文档得分的最高分
  - hits:搜索结果的文档对象数组,每个元素是一条搜索到的文档信息
    - _index:索引库
    - _type:文档类型
    - _id:文档id
    - _score:文档得分
    - _source:文档的源数据
View Code

 

 

# 匹配查询

GET /索引库名/_search
{
"query": {
"match": {
"title": {
"query": "小米手机电视",
"minimum_should_match": "60%"
}
}
}
}

 


#多字段查询 

title,subTitle字段名

GET /索引库名/_search
{
"query": {
"multi_match": {
"query": "小米",
"fields":["title","subTitle"]
}
}
}

 

#1.词条查询     

 可分割的最小词条单位   title为字段名  [ "字段值" ]

GET /索引库名/_search
{
  "query": {
    "terms": {
        "title": ["小米","手机"]
    }
  }
}

 

 

#2.多词条查询

GET /索引库名/_search
{
"query": {
"terms": {
"title": ["小米","手机"]
}
}
}

 

 

# 结果过滤   

excludes:不显示的字段    includes: 显示的字段

GET /索引库名/_search
{
"_source": {
"excludes": "{images}"
}, 
"query": {
"terms": {
"title": ["小米","手机"]
}
}
}

 

 

#布尔查询

标题一定有小米,或者价格为2699,4699

bool把各种其它查询通过must(与)、must_not(非)、should(或)的方式进行组合

GET /索引库名/_search
{
"query": {
"bool": {
"must": [
{"match": {
"title": "小米"
}
}
],
"should": [
{"terms": {
"price": [
"2699",
"2799"
]
}}
]
}
}
}

 

# 范围查询

价格大于等于2799 小于等于3899

GET /索引库名/_search
{
"query": {
"range": {
"price": {
"gte": 2799,
"lte": 3899
}
}
}
}

  

# 模糊查询

标题为oppo 默认允许错误一个字母,最大为两个字母 正确标题 oppo

fuzziness:配置篇里

GET /索引库名/_search
{
"query": {
"fuzzy": {
"title": {
"value": "oope",
"fuzziness": 2
}
}
}
}

 


# 过滤filter

不会影响查询的分数_score

GET /索引库名/_search
{
"query": {
"bool": {
"must": [
{
"match": {
"title": "小米"
}
}
],
"filter": [
{
"range": {
"price": {
"gte": 2699,
"lte": 4999
}
}
}
]
}
}
}

 

#排序

GET /索引库名/_search
{
"query": {
"bool": {
"filter": [
{
"range": {
"price": {
"gte": 2699,
"lte": 4999
}
}
}
]
}
},
"sort": [
{
"price": {
"order": "desc"
}
},
{
"_id":{
"order": "asc"
}
}
]
}

 

聚合 aggregations

聚合可以让我们极其方便的实现对数据的统计、分析。例如:

  • 什么品牌的手机最受欢迎?

  • 这些手机的平均价格、最高价格、最低价格?

  • 这些手机每月的销售情况如何?

实现这些统计功能的比数据库的sql要方便的多,而且查询速度非常快,可以实现实时搜索效果。

 

4.1 基本概念

Elasticsearch中的聚合,包含多种类型,最常用的两种,一个叫,一个叫度量

桶(bucket)

桶的作用,是按照某种方式对数据进行分组,每一组数据在ES中称为一个,例如我们根据国籍对人划分,可以得到中国桶英国桶日本桶……或者我们按照年龄段对人进行划分:0~10,10~20,20~30,30~40等。

Elasticsearch中提供的划分桶的方式有很多:

  • Date Histogram Aggregation:根据日期阶梯分组,例如给定阶梯为周,会自动每周分为一组

  • Histogram Aggregation:根据数值阶梯分组,与日期类似

  • Terms Aggregation:根据词条内容分组,词条内容完全匹配的为一组

  • Range Aggregation:数值和日期的范围分组,指定开始和结束,然后按段分组

  • ……

 

bucket aggregations 只负责对数据进行分组,并不进行计算,因此往往bucket中往往会嵌套另一种聚合:metrics aggregations即度量

 

度量(metrics)

分组完成以后,我们一般会对组中的数据进行聚合运算,例如求平均值、最大、最小、求和等,这些在ES中称为度量

比较常用的一些度量聚合方式:

  • Avg Aggregation:求平均值

  • Max Aggregation:求最大值

  • Min Aggregation:求最小值

  • Percentiles Aggregation:求百分比

  • Stats Aggregation:同时返回avg、max、min、sum、count等

  • Sum Aggregation:求和

  • Top hits Aggregation:求前几

  • Value Count Aggregation:求总数

  • …… 

使用聚合先加入新的索引

PUT /cars
{
"settings": {
"number_of_shards": 1,
"number_of_replicas": 0
},
"mappings": {
"properties": {
"color": {
"type": "keyword"
},
"make": {
"type": "keyword"
}
}
}
}

批量添加数据

POST /cars/_bulk
{ "index": {}}
{ "price" : 10000, "color" : "red", "make" : "honda", "sold" : "2014-10-28" }
{ "index": {}}
{ "price" : 20000, "color" : "red", "make" : "honda", "sold" : "2014-11-05" }
{ "index": {}}
{ "price" : 30000, "color" : "green", "make" : "ford", "sold" : "2014-05-18" }
{ "index": {}}
{ "price" : 15000, "color" : "blue", "make" : "toyota", "sold" : "2014-07-02" }
{ "index": {}}
{ "price" : 12000, "color" : "green", "make" : "toyota", "sold" : "2014-08-19" }
{ "index": {}}
{ "price" : 20000, "color" : "red", "make" : "honda", "sold" : "2014-11-05" }
{ "index": {}}
{ "price" : 80000, "color" : "red", "make" : "bmw", "sold" : "2014-01-01" }
{ "index": {}}
{ "price" : 25000, "color" : "blue", "make" : "ford", "sold" : "2014-02-12" }

 

 

 

#聚合为桶

 

GET /cars/_search
{
"aggs": {
"color": {
"terms": {
"field": "color"
}
}
}
}

 

#桶内度量   

GET /cars/_search
{
"size": 0, 
"aggs": {
"color": {
"terms": {
"field": "color"
},
"aggs": {
"avg_price": {
"avg": {
"field": "price"
}
}
}
}
}
}

 

#桶内嵌套桶

GET /cars/_search
{
"size": 0,
"aggs": {
"color": {
"terms": {
"field": "color"
},
"aggs": {
"avg_price": {
"avg": {
"field": "price"
}
},
"mark":{
"terms": {
"field": "make"
}
}
}
}
}
}

 

 

#阶梯分组

对价格进行阶梯分组,最小数量为1才显示

GET /cars/_search
{
"size": 0,
"aggs": {
"price_histogram": {
"histogram": {
"field": "price",
"interval": 5000,
"min_doc_count": 1
}
}
}
}

 

#范围分组

GET /cars/_search
{
"size": 0,
"aggs": {
"price_range": {
"range": {
"field": "price",
"ranges": [
{
"from": 5000,
"to": 15000
},
{
"from": 15000,
"to": 20000
},
{
"from": 20000,
"to": 25000
},
{
"from": 25000,
"to":35000
},
{
"from": 35000,
"to":40000
}
]
}
}
}
}

 

以上是关于使用kibana操作elasticsearch7.x 教程的主要内容,如果未能解决你的问题,请参考以下文章

Linux 安装ElasticSearch7.6.2和Kibana7.6.2

Docker部署单节点ElasticSearch7+配置kibana7+X-Pack

Elasticsearch入门——Elasticsearch7.8.0版本和Kibana7.8.0版本的下载安装(win10环境)

Elasticsearch入门——Elasticsearch7.8.0版本和Kibana7.8.0版本的下载安装(win10环境)

elasticsearch7.x 开启安全认证xpack,以及kibanalogstashfilebeat组件连接开启安全认证的es;

elasticsearch7.5.0+kibana-7.5.0+cerebro-0.8.5集群生产环境安装配置及通过elasticsearch-migration工具做新老集群数据迁移