ES是一个分布式的全文搜索引擎
我们对数据库比较熟悉,刚开始了解ES时可以跟MySQL进行对比
对比 | MySQL | ES |
---|---|---|
数据库 | DB | Index |
表 | Table | Type |
列 | Colomn | Field |
行 | Record | Document |
MySQL是关系型数据库,里面的数据是一行行数据。而ES是以一条条Document(文档)为单位存储的。Document的结构就是Json数据结构。
我们举例一条Document分析下结构
{
"_index" : "erp-abc", // 索引(数据库)
"_type" : "logging", // 类型(表)
"_id" : "1", // id
"_score" : 1.0, // 得分
"_source" : { // 数据
"threadId" : 577,
"hostName" : "1.1.1",
"companyId" : -1,
"level" : "INFO",
"logger" : "xxx",
"message" : "xxx",
"clueId" : "123456",
"staffId" : -1,
"applicationName" : "xxx",
"threadName" : "JobRunnerPool-thread-6",
"timestamp" : "2022-07-25T14:17:04.479+08:00"
}
相对应MySQL存储的话如下
logger表
id | companyId | logger | message | clueId… |
---|---|---|---|---|
1 | -1 | xxx | xxx | 123456 |
上一节我们学习了怎么安装ELK,好了接下来我们可以通过Kibana学习下ES的增删改查语句
GET / // 查看版本
GET /_cat/nodes?v // 查看节点
GET /_cat/indices?v // 查看索引
GET /_cat/shards?v // 查看分片
GET /erp-basis/logging/_mapping // 查看索引类型结构
PUT /test-index // 新增索引
DELETE /test-index // 删除索引
PUT /test-index/test-type/1 // 新增文档
{ "test": "1" }
POST /test-index/test-type/1_update // 修改文档
{ "test": "2" }
GET /test-index/test-type/1 // 文档详情
DELETE /test-index/test-type/1 // 删除文档
下面重点讲下ES的查询语句,对比MySQL方便理解
含义 | ES | MySQL |
---|---|---|
match_all 查询全部 | GET /erp-xx/logging/_search {“query”: {“match_all”: {}}} | select * from erp-xx.logging |
sort 排序 | GET /erp-wms/logging/_search {“query”: {“match_all”: {}},“sort”: { “timestamp”: { “order”: “desc” } }} | select * from erp-xx.logging order by timestamp DESC |
from&size 分页 | GET /erp-wms/logging/_search {“query”: {“match_all”: {}},“from”: 0,“size”: 1} | select * from erp-xx.logging limit 1 |
match 模糊匹配(会先分词) | GET /erp-wms/logging/_search {“query”: {“match”: {“message”:“波次安排”}}} | select * from erp-xx.logging where message like ‘%波次%’ or message like ‘%安排%’ |
term 精准匹配 | GET /erp-wms/logging/_search {“query”: {“term”: {“level”: {“value”: “ERROR”}}}} | select * from erp-xx.logging where level = ‘ERROR’ |
match_phase 短语匹配(整体单词匹配) | GET /erp-wms/logging/_search {“query”: {“match_phrase”: {“message”:“波次 安排”}}} | select * from erp-xx.logging where message like ‘%波次 安排%’ |
bool (must/must_not/should )复合查询 | GET /erp-wms/logging/_search {“query”: { “bool”: { “should”: [ {“term”: { “level”: “ERROR” }}, {“bool”: { “must”: [ {“term”: { “message”: “波次完成”}}], “must_not”: [ {“term”: { “message”: “无”}}]}}]}}} | select * from erp-xx.logging where (message = ‘波次完成’ and message != ‘无’ ) or level = ‘ERROR’ |
filter 范围过滤 | GET /erp-wms/logging/_search {“query”: { “bool”: { “filter”: { “range”: { “threadId”: {“gte”: 100, “lte”: 200 }} } }}} | select * from erp-xx.logging where threadId > 100 and threadId < 200 |
aggs 分组聚合 | GET /erp-wms/logging/_search {“size”: 0, “aggs”: { “group_by_companyName”: { “terms”: { “field”:“companyName” }}}} | select companyName,count(*) from erp-xx.logging group by companyName |