Elasticsearch 速查表

本文档整理了 Elasticsearch 常用的 API 和命令，方便快速查阅。建议将此页面加入书签，在日常工作中随时参考。

集群管理

集群状态

# 查看集群健康状况
GET /_cluster/health

# 查看集群节点
GET /_cat/nodes?v

# 查看集群设置
GET /_cluster/settings

# 查看集群统计
GET /_cluster/stats

# 查看集群信息
GET /

节点管理

# 查看节点信息
GET /_nodes

# 查看节点统计
GET /_nodes/stats

# 查看节点热点线程
GET /_nodes/hot_threads

# 查看特定节点信息
GET /_nodes/node-1

索引操作

索引管理

# 创建索引
PUT /index_name
{
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1
  }
}

# 删除索引
DELETE /index_name

# 删除多个索引
DELETE /index1,index2

# 删除匹配模式的索引
DELETE /logs-*

# 查看所有索引
GET /_cat/indices?v

# 查看索引设置
GET /index_name/_settings

# 查看索引映射
GET /index_name/_mapping

# 打开索引
POST /index_name/_open

# 关闭索引
POST /index_name/_close

# 刷新索引
POST /index_name/_refresh

# 刷新所有索引
POST /_refresh

# 强制合并段
POST /index_name/_forcemerge?max_num_segments=1

# 清空缓存
POST /index_name/_cache/clear

索引别名

# 创建别名
POST /_aliases
{
  "actions": [
    { "add": { "index": "index_name", "alias": "alias_name" } }
  ]
}

# 删除别名
POST /_aliases
{
  "actions": [
    { "remove": { "index": "index_name", "alias": "alias_name" } }
  ]
}

# 切换别名（原子操作）
POST /_aliases
{
  "actions": [
    { "remove": { "index": "old_index", "alias": "alias_name" } },
    { "add": { "index": "new_index", "alias": "alias_name" } }
  ]
}

# 查看别名
GET /_alias/alias_name
GET /index_name/_alias
GET /_aliases

索引模板

# 创建模板
PUT /_index_template/template_name
{
  "index_patterns": ["logs-*"],
  "template": {
    "settings": { "number_of_shards": 1 }
  }
}

# 查看模板
GET /_index_template/template_name

# 查看所有模板
GET /_index_template

# 删除模板
DELETE /_index_template/template_name

文档操作

CRUD 操作

# 创建文档（指定 ID）
PUT /index_name/_doc/1
{ "field": "value" }

# 创建文档（自动生成 ID）
POST /index_name/_doc
{ "field": "value" }

# 创建文档（不存在时创建）
PUT /index_name/_create/1
{ "field": "value" }

# 获取文档
GET /index_name/_doc/1

# 获取文档源数据
GET /index_name/_source/1

# 获取特定字段
GET /index_name/_doc/1?_source=field1,field2

# 检查文档是否存在
HEAD /index_name/_doc/1

# 更新文档（部分更新）
POST /index_name/_update/1
{
  "doc": { "field": "new_value" }
}

# 更新文档（脚本更新）
POST /index_name/_update/1
{
  "script": {
    "source": "ctx._source.counter += params.increment",
    "params": { "increment": 1 }
  }
}

# Upsert（存在更新，不存在创建）
POST /index_name/_update/1
{
  "doc": { "field": "value" },
  "doc_as_upsert": true
}

# 删除文档
DELETE /index_name/_doc/1

批量操作

# 批量操作
POST /_bulk
{"index": {"_index": "index_name", "_id": "1"}}
{"field": "value1"}
{"index": {"_index": "index_name", "_id": "2"}}
{"field": "value2"}
{"update": {"_index": "index_name", "_id": "1"}}
{"doc": {"field": "updated"}}
{"delete": {"_index": "index_name", "_id": "3"}}

# 批量获取
GET /_mget
{
  "docs": [
    { "_index": "index_name", "_id": "1" },
    { "_index": "index_name", "_id": "2" }
  ]
}

# 同索引批量获取
GET /index_name/_mget
{
  "ids": ["1", "2", "3"]
}

# 按查询删除
POST /index_name/_delete_by_query
{
  "query": { "match": { "field": "value" } }
}

# 按查询更新
POST /index_name/_update_by_query
{
  "query": { "match": { "field": "value" } },
  "script": { "source": "ctx._source.field = 'new_value'" }
}

# 重建索引
POST /_reindex
{
  "source": { "index": "source_index" },
  "dest": { "index": "dest_index" }
}

查询语法

基本查询

# 查询所有文档
GET /index_name/_search
{ "query": { "match_all": {} } }

# match 查询（全文搜索）
GET /index_name/_search
{
  "query": {
    "match": { "field": "search text" }
  }
}

# match 查询（AND 操作符）
GET /index_name/_search
{
  "query": {
    "match": {
      "field": {
        "query": "search text",
        "operator": "and"
      }
    }
  }
}

# match_phrase 查询（短语匹配）
GET /index_name/_search
{
  "query": {
    "match_phrase": { "field": "exact phrase" }
  }
}

# multi_match 查询（多字段搜索）
GET /index_name/_search
{
  "query": {
    "multi_match": {
      "query": "search text",
      "fields": ["field1", "field2^2"]
    }
  }
}

精确查询

# term 查询（精确匹配）
GET /index_name/_search
{
  "query": {
    "term": { "field": "exact_value" }
  }
}

# terms 查询（多个值）
GET /index_name/_search
{
  "query": {
    "terms": { "field": ["value1", "value2"] }
  }
}

# range 查询（范围查询）
GET /index_name/_search
{
  "query": {
    "range": {
      "field": {
        "gte": 10,
        "lte": 100
      }
    }
  }
}

# 日期范围查询
GET /index_name/_search
{
  "query": {
    "range": {
      "date_field": {
        "gte": "2024-01-01",
        "lt": "2024-02-01"
      }
    }
  }
}

# 相对日期查询
GET /index_name/_search
{
  "query": {
    "range": {
      "date_field": {
        "gte": "now-7d/d",
        "lt": "now/d"
      }
    }
  }
}

# exists 查询（字段存在）
GET /index_name/_search
{
  "query": {
    "exists": { "field": "field_name" }
  }
}

# ids 查询（按 ID 查询）
GET /index_name/_search
{
  "query": {
    "ids": { "values": ["1", "2", "3"] }
  }
}

# prefix 查询（前缀匹配）
GET /index_name/_search
{
  "query": {
    "prefix": { "field": "pre" }
  }
}

# wildcard 查询（通配符）
GET /index_name/_search
{
  "query": {
    "wildcard": { "field": "val*" }
  }
}

复合查询

# bool 查询
GET /index_name/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "title": "search" } }
      ],
      "must_not": [
        { "term": { "status": "draft" } }
      ],
      "should": [
        { "term": { "category": "tech" } }
      ],
      "filter": [
        { "range": { "views": { "gte": 100 } } }
      ],
      "minimum_should_match": 1
    }
  }
}

# boosting 查询
GET /index_name/_search
{
  "query": {
    "boosting": {
      "positive": { "match": { "title": "search" } },
      "negative": { "term": { "status": "old" } },
      "negative_boost": 0.5
    }
  }
}

# constant_score 查询
GET /index_name/_search
{
  "query": {
    "constant_score": {
      "filter": { "term": { "status": "published" } },
      "boost": 1.2
    }
  }
}

聚合分析

Bucket 聚合

# terms 聚合（分组统计）
GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "group_by_field": {
      "terms": { "field": "category.keyword" }
    }
  }
}

# range 聚合（范围分组）
GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          { "to": 100 },
          { "from": 100, "to": 500 },
          { "from": 500 }
        ]
      }
    }
  }
}

# date_histogram 聚合（时间直方图）
GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "over_time": {
      "date_histogram": {
        "field": "created_at",
        "calendar_interval": "day"
      }
    }
  }
}

# histogram 聚合（数值直方图）
GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "price_histogram": {
      "histogram": {
        "field": "price",
        "interval": 100
      }
    }
  }
}

# filter 聚合（过滤后聚合）
GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "published": {
      "filter": { "term": { "status": "published" } },
      "aggs": {
        "avg_views": { "avg": { "field": "views" } }
      }
    }
  }
}

Metric 聚合

# 基本统计
GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "avg_price": { "avg": { "field": "price" } },
    "max_price": { "max": { "field": "price" } },
    "min_price": { "min": { "field": "price" } },
    "sum_price": { "sum": { "field": "price" } },
    "count": { "value_count": { "field": "price" } }
  }
}

# stats 聚合（综合统计）
GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "price_stats": {
      "stats": { "field": "price" }
    }
  }
}

# extended_stats 聚合（扩展统计）
GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "price_stats": {
      "extended_stats": { "field": "price" }
    }
  }
}

# cardinality 聚合（去重计数）
GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "unique_authors": {
      "cardinality": {
        "field": "author.keyword",
        "precision_threshold": 1000
      }
    }
  }
}

# percentiles 聚合（百分位数）
GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "price_percentiles": {
      "percentiles": {
        "field": "price",
        "percents": [50, 75, 90, 95, 99]
      }
    }
  }
}

# top_hits 聚合（获取文档）
GET /index_name/_search
{
  "size": 0,
  "aggs": {
    "by_category": {
      "terms": { "field": "category.keyword" },
      "aggs": {
        "top_docs": {
          "top_hits": {
            "size": 3,
            "sort": [{ "views": "desc" }]
          }
        }
      }
    }
  }
}

分页和排序

# 基本分页
GET /index_name/_search
{
  "from": 0,
  "size": 10,
  "query": { "match_all": {} }
}

# 排序
GET /index_name/_search
{
  "query": { "match_all": {} },
  "sort": [
    { "created_at": "desc" },
    { "_score": "desc" }
  ]
}

# search_after 分页
GET /index_name/_search
{
  "size": 10,
  "sort": [
    { "created_at": "desc" },
    { "_id": "desc" }
  ],
  "search_after": ["2024-01-15", "abc123"]
}

# scroll 滚动查询
GET /index_name/_search?scroll=1m
{
  "size": 1000,
  "query": { "match_all": {} }
}

# 获取下一页
GET /_search/scroll
{
  "scroll": "1m",
  "scroll_id": "scroll_id_value"
}

# 清除滚动
DELETE /_search/scroll
{
  "scroll_id": "scroll_id_value"
}

映射和数据类型

常用数据类型

类型	说明
`text`	全文搜索，会被分词
`keyword`	精确匹配，不分词
`integer`	32 位整数
`long`	64 位整数
`float`	单精度浮点数
`double`	双精度浮点数
`boolean`	布尔值
`date`	日期时间
`object`	嵌套对象
`nested`	嵌套数组（独立索引）
`geo_point`	地理坐标
`dense_vector`	向量（用于 kNN 搜索）

映射示例

PUT /index_name
{
  "mappings": {
    "properties": {
      "title": {
        "type": "text",
        "analyzer": "ik_max_word",
        "search_analyzer": "ik_smart"
      },
      "status": { "type": "keyword" },
      "price": { "type": "float" },
      "count": { "type": "integer" },
      "is_active": { "type": "boolean" },
      "created_at": {
        "type": "date",
        "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_millis"
      },
      "tags": { "type": "keyword" },
      "location": { "type": "geo_point" },
      "author": {
        "type": "object",
        "properties": {
          "name": { "type": "keyword" },
          "email": { "type": "keyword" }
        }
      },
      "comments": {
        "type": "nested",
        "properties": {
          "user": { "type": "keyword" },
          "content": { "type": "text" }
        }
      }
    }
  }
}

性能优化

写入优化

# 批量写入前临时设置
PUT /index_name/_settings
{
  "number_of_replicas": 0,
  "refresh_interval": "-1"
}

# 批量写入后恢复
PUT /index_name/_settings
{
  "number_of_replicas": 1,
  "refresh_interval": "1s"
}

# 手动刷新
POST /index_name/_refresh

# 强制合并段
POST /index_name/_forcemerge?max_num_segments=1

查询优化

# 使用 filter 代替 must（会缓存）
GET /index_name/_search
{
  "query": {
    "bool": {
      "filter": [
        { "term": { "status": "published" } }
      ]
    }
  }
}

# 只返回需要的字段
GET /index_name/_search
{
  "query": { "match_all": {} },
  "_source": ["title", "author"]
}

# 使用 filter_path 过滤响应
GET /index_name/_search?filter_path=hits.hits._id,hits.hits._source

# Profile API 分析查询
GET /index_name/_search
{
  "profile": true,
  "query": { "match": { "title": "search" } }
}

监控和调试

查看统计

# 索引统计
GET /index_name/_stats

# 索引段信息
GET /index_name/_segments

# 查询解释
GET /index_name/_explain/1
{
  "query": { "match": { "title": "search" } }
}

# 分析器测试
GET /index_name/_analyze
{
  "analyzer": "standard",
  "text": "Hello World"
}

# 字段分析测试
GET /index_name/_analyze
{
  "field": "title",
  "text": "测试文本"
}

任务管理

# 查看任务
GET /_tasks

# 查看特定任务
GET /_tasks/task_id

# 取消任务
POST /_tasks/task_id/_cancel

# 按条件取消任务
POST /_tasks/_cancel?actions=*reindex

常用 Cat API

# 查看所有索引
GET /_cat/indices?v

# 查看分片
GET /_cat/shards?v

# 查看别名
GET /_cat/aliases?v

# 查看健康状态
GET /_cat/health?v

# 查看节点
GET /_cat/nodes?v

# 查看线程池
GET /_cat/thread_pool?v

# 查看磁盘使用
GET /_cat/allocation?v

# 查看恢复状态
GET /_cat/recovery?v

# 查看主节点
GET /_cat/master?v

# 查看索引模板
GET /_cat/templates?v

快照和恢复

# 创建仓库
PUT /_snapshot/my_backup
{
  "type": "fs",
  "settings": {
    "location": "/mount/backups/my_backup",
    "compress": true
  }
}

# 查看仓库
GET /_snapshot

# 创建快照
PUT /_snapshot/my_backup/snapshot_1

# 创建快照（指定索引）
PUT /_snapshot/my_backup/snapshot_2
{
  "indices": "index1,index2",
  "ignore_unavailable": true
}

# 查看快照
GET /_snapshot/my_backup/snapshot_1

# 查看快照状态
GET /_snapshot/my_backup/snapshot_1/_status

# 恢复快照
POST /_snapshot/my_backup/snapshot_1/_restore

# 恢复指定索引
POST /_snapshot/my_backup/snapshot_1/_restore
{
  "indices": "index1",
  "rename_pattern": "(.+)",
  "rename_replacement": "restored_$1"
}

# 删除快照
DELETE /_snapshot/my_backup/snapshot_1

小结

本速查表涵盖了 Elasticsearch 常用操作：

集群管理 API
索引操作
文档 CRUD
查询语法
聚合分析
分页和排序
映射配置
性能优化
监控调试
快照恢复

集群管理​

集群状态​

节点管理​

索引操作​

索引管理​

索引别名​

索引模板​

文档操作​

CRUD 操作​

批量操作​

查询语法​

基本查询​

精确查询​

复合查询​

聚合分析​

Bucket 聚合​

Metric 聚合​

分页和排序​

映射和数据类型​

常用数据类型​

映射示例​

性能优化​

写入优化​

查询优化​

监控和调试​

查看统计​

任务管理​

常用 Cat API​

快照和恢复​

小结​

参考资料​

集群管理

集群状态

节点管理

索引操作

索引管理

索引别名

索引模板

文档操作

CRUD 操作

批量操作

查询语法

基本查询

精确查询

复合查询

聚合分析

Bucket 聚合

Metric 聚合

分页和排序

映射和数据类型

常用数据类型

映射示例

性能优化

写入优化

查询优化

监控和调试

查看统计

任务管理

常用 Cat API

快照和恢复

小结

参考资料