Elasticsearch 速查表

本文档整理了 Elasticsearch 常用的 API 和命令，方便快速查阅。

集群管理

集群状态

# 查看集群健康状态
GET /_cluster/health

# 查看集群节点
GET /_cat/nodes?v

# 查看集群设置
GET /_cluster/settings

# 查看集群统计
GET /_cluster/stats

节点管理

# 查看节点信息
GET /_nodes

# 查看节点统计
GET /_nodes/stats

# 查看节点热点线程
GET /_nodes/hot_threads

索引操作

索引管理

# 创建索引
PUT /index_name
{
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1
  }
}

# 删除索引
DELETE /index_name

# 查看索引设置
GET /index_name/_settings

# 查看索引映射
GET /index_name/_mapping

# 打开/关闭索引
POST /index_name/_open
POST /index_name/_close

# 刷新索引
POST /index_name/_refresh

# 强制合并段
POST /index_name/_forcemerge?max_num_segments=1

索引别名

# 创建别名
POST /_aliases
{
  "actions": [
    { "add": { "index": "index_name", "alias": "alias_name" } }
  ]
}

# 删除别名
POST /_aliases
{
  "actions": [
    { "remove": { "index": "index_name", "alias": "alias_name" } }
  ]
}

# 查看别名
GET /_alias/alias_name
GET /index_name/_alias

索引模板

# 创建模板
PUT /_index_template/template_name
{
  "index_patterns": ["logs-*"],
  "template": {
    "settings": { "number_of_shards": 1 }
  }
}

# 查看模板
GET /_index_template/template_name

# 删除模板
DELETE /_index_template/template_name

文档操作

CRUD 操作

# 创建文档（指定 ID）
PUT /index_name/_doc/1
{ "field": "value" }

# 创建文档（自动 ID）
POST /index_name/_doc
{ "field": "value" }

# 获取文档
GET /index_name/_doc/1

# 更新文档
POST /index_name/_update/1
{
  "doc": { "field": "new_value" }
}

# 删除文档
DELETE /index_name/_doc/1

批量操作

# 批量操作
POST /_bulk
{"index": {"_index": "index_name", "_id": "1"}}
{"field": "value1"}
{"index": {"_index": "index_name", "_id": "2"}}
{"field": "value2"}

# 批量获取
GET /_mget
{
  "docs": [
    { "_index": "index_name", "_id": "1" },
    { "_index": "index_name", "_id": "2" }
  ]
}

# 按查询删除
POST /index_name/_delete_by_query
{
  "query": { "match": { "field": "value" } }
}

# 按查询更新
POST /index_name/_update_by_query
{
  "query": { "match": { "field": "value" } },
  "script": { "source": "ctx._source.field = 'new_value'" }
}

查询语法

基本查询

# 查询所有
GET /index_name/_search
{ "query": { "match_all": {} } }

# match 查询
GET /index_name/_search
{
  "query": {
    "match": { "field": "search text" }
  }
}

# match_phrase 查询
GET /index_name/_search
{
  "query": {
    "match_phrase": { "field": "exact phrase" }
  }
}

# multi_match 查询
GET /index_name/_search
{
  "query": {
    "multi_match": {
      "query": "search text",
      "fields": ["field1", "field2"]
    }
  }
}

精确查询

# term 查询
GET /index_name/_search
{
  "query": {
    "term": { "field": "exact_value" }
  }
}

# terms 查询（多个值）
GET /index_name/_search
{
  "query": {
    "terms": { "field": ["value1", "value2"] }
  }
}

# range 查询
GET /index_name/_search
{
  "query": {
    "range": {
      "field": {
        "gte": 10,
        "lte": 100
      }
    }
  }
}

# exists 查询
GET /index_name/_search
{
  "query": {
    "exists": { "field": "field_name" }
  }
}

复合查询

# bool 查询
GET /index_name/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "title": "search" } }
      ],
      "must_not": [
        { "term": { "status": "draft" } }
      ],
      "should": [
        { "term": { "category": "tech" } }
      ],
      "filter": [
        { "range": { "views": { "gte": 100 } } }
      ]
    }
  }
}

# boosting 查询
GET /index_name/_search
{
  "query": {
    "boosting": {
      "positive": { "match": { "title": "search" } },
      "negative": { "term": { "status": "old" } },
      "negative_boost": 0.5
    }
  }
}

聚合分析

基本聚合

# terms 聚合（分组统计）
GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "group_by_field": {
      "terms": { "field": "category.keyword" }
    }
  }
}

# stats 聚合（统计信息）
GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "stats_name": {
      "stats": { "field": "price" }
    }
  }
}

# date_histogram 聚合（时间直方图）
GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "over_time": {
      "date_histogram": {
        "field": "created_at",
        "calendar_interval": "day"
      }
    }
  }
}

嵌套聚合

GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "by_category": {
      "terms": { "field": "category.keyword" },
      "aggs": {
        "avg_price": {
          "avg": { "field": "price" }
        },
        "top_hits": {
          "top_hits": { "size": 3 }
        }
      }
    }
  }
}

分页和排序

# 基本分页
GET /index_name/_search
{
  "from": 0,
  "size": 10,
  "query": { "match_all": {} }
}

# 排序
GET /index_name/_search
{
  "query": { "match_all": {} },
  "sort": [
    { "created_at": "desc" },
    { "_score": "desc" }
  ]
}

# search_after 分页
GET /index_name/_search
{
  "size": 10,
  "sort": [
    { "created_at": "desc" },
    { "_id": "desc" }
  ],
  "search_after": ["2024-01-15", "abc123"]
}

# scroll 滚动查询
GET /index_name/_search?scroll=1m
{
  "size": 1000,
  "query": { "match_all": {} }
}

映射和数据类型

常用数据类型

类型	说明
text	全文搜索，会被分词
keyword	精确匹配，不分词
integer	整数
float	浮点数
boolean	布尔值
date	日期
object	嵌套对象
nested	嵌套数组
geo_point	地理坐标

映射示例

PUT /index_name
{
  "mappings": {
    "properties": {
      "title": { "type": "text" },
      "status": { "type": "keyword" },
      "price": { "type": "float" },
      "count": { "type": "integer" },
      "is_active": { "type": "boolean" },
      "created_at": { "type": "date" },
      "tags": { "type": "keyword" },
      "location": { "type": "geo_point" }
    }
  }
}

性能优化

写入优化

# 批量写入前临时设置
PUT /index_name/_settings
{
  "number_of_replicas": 0,
  "refresh_interval": "-1"
}

# 批量写入后恢复
PUT /index_name/_settings
{
  "number_of_replicas": 1,
  "refresh_interval": "1s"
}

# 手动刷新
POST /index_name/_refresh

查询优化

# 使用 filter 代替 must（会缓存）
GET /index_name/_search
{
  "query": {
    "bool": {
      "filter": [
        { "term": { "status": "published" } }
      ]
    }
  }
}

# 只返回需要的字段
GET /index_name/_search
{
  "query": { "match_all": {} },
  "_source": ["title", "author"]
}

# 使用 scroll 进行大量数据导出
GET /index_name/_search?scroll=1m
{
  "size": 1000
}

监控和调试

查看统计

# 索引统计
GET /index_name/_stats

# 索引段信息
GET /index_name/_segments

# 查询解释
GET /index_name/_explain/1
{
  "query": {
    "match": { "title": "search" }
  }
}

# 查询分析
GET /index_name/_analyze
{
  "analyzer": "standard",
  "text": "Hello World"
}

任务管理

# 查看任务
GET /_tasks

# 取消任务
POST /_tasks/task_id/_cancel

常用 cat API

# 查看所有索引
GET /_cat/indices?v

# 查看分片
GET /_cat/shards?v

# 查看别名
GET /_cat/aliases?v

# 查看健康状态
GET /_cat/health?v

# 查看节点
GET /_cat/nodes?v

# 查看线程池
GET /_cat/thread_pool?v

# 查看磁盘使用
GET /_cat/allocation?v

快照和恢复

# 创建仓库
PUT /_snapshot/my_backup
{
  "type": "fs",
  "settings": {
    "location": "/mount/backups/my_backup"
  }
}

# 创建快照
PUT /_snapshot/my_backup/snapshot_1

# 查看快照
GET /_snapshot/my_backup/snapshot_1

# 恢复快照
POST /_snapshot/my_backup/snapshot_1/_restore
{
  "indices": "index1,index2"
}

小结

本速查表涵盖了 Elasticsearch 常用操作：

1. 集群管理 API
2. 索引操作
3. 文档 CRUD
4. 查询语法
5. 聚合分析
6. 分页和排序
7. 映射配置
8. 性能优化
9. 监控调试

参考资源

• Elasticsearch 官方文档
• Elasticsearch API 速查