iconic日记-Elasticsearch
01
—
Elasticsearch基础
下载
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-${VERSION}-linux-x86_64.tar.gzwget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-${VERSION}-linux-x86_64.tar.gz.sha512shasum -a 512 -c elasticsearch-${VERSION}-linux-x86_64.tar.gz.sha512ar -xzf elasticsearch-${VERSION}-linux-x86_64.tar.gzcd elasticsearch-${VERSION}/##linuxcurl -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-${VERSION}-darwin-x86_64.tar.gzcurl https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-${VERSION}-darwin-x86_64.tar.gz.sha512 | shasum -a 512 -c -tar -xzf elasticsearch-${VERSION}-darwin-x86_64.tar.gzcd elasticsearch-${VERSION}/##mac##自行下载https://www.elastic.co/cn/downloads/elasticsearch?spm=a2c6h.13046898.publish-article.14.7a516ffapYAX3h
启动
./bin/elasticsearch#启动Elasticsearchexport ELASTIC_PASSWORD="your_password"#设置密码curl --cacert $ES_HOME/config/certs/http_ca.crt -u elastic:$ELASTIC_PASSWORD https://localhost:9200#测试是否启动成功{"name" : "iconic","cluster_name" : "elasticsearch","cluster_uuid" : "AT213_T_DTp-1qdwdzqqA","version" : {"number" : "${VERSION}","build_type" : "tar","build_hash" : "f21313d","build_flavor" : "default","build_date" : "2024-07-30T09:51:41.449Z","build_snapshot" : false,"lucene_version" : "9.10.0","minimum_wire_compatibility_version" : "1.23.3","minimum_index_compatibility_version" : "1.23.3"},"tagline" : "You Know, for Search"}#返回成功样例
对比
| RDMS | Elasticsearch |
|---|---|
| 数据库(database) | 索引(index) |
| 表(table) | 类型(type) |
| 行(row) | 文档(document) |
| 列(column) | 字段(field) |
| 表结构 | 映射 |
| 索引 | 全文索引 |
| SQL | 查询DSL |
| SELECT * FROM tablename | GET http://... |
| UPDATE table SET | PUT http://... |
| DELETE | DELETE http://... |
02
—
ES常用命令
基本语法
curl -X<VERB> '<PROTOCOL>://<HOST>:<PORT>/<PATH>?<QUERY_STRING>' -d '<BODY>'##VERB HTTP 方法：GET、POST、 PUT、 HEAD、 DELETE##PROTOCOL：http 或者 https 协议（只有在 Elasticsearch 前面有 https 代理的时候可用）##HOST：Elasticsearch 集群中的任何一个节点的主机名，如果是在本地的节点，那么就叫 localhost##PORT：Elasticsearch HTTP 服务所在的端口，默认为 9200##PATH API 路径（例如_count 将返回集群中文档的数量），PATH：可以包含多个组件，例如_cluster/stats 或者_nodes/stats/jvm##QUERY_STRING：一些可选的查询请求参数，例如?pretty 参数将使请求返回更加美观易读的 JSON 数据##BODY：一个 JSON 格式的请求主体（如果请求需要的话）
##请求 api 前缀##http://localhost:9200/##DSL语法##PUT /user_info{"settings": { "number_of_replicas": 1, "number_of_shards": 1 },"mappings": {"properties": {"id": { "type": "long", "index": true },"username": { "type": "keyword", "index": true },"nickname": { "type": "keyword", "index": true },"password": { "type": "keyword", "index": false },"age": { "type": "integer", "index": true },"info": { "type": "text", "index": true },"remark": { "type": "text", "index": true }}}}##curl##curl -XPUT "http://localhost:9200/user_info" -H 'Content-Type: application/json' -d'{ "settings": { "number_of_replicas": 1, "number_of_shards": 1 }, "mappings": { "properties": { "id": { "type": "long", "index": true }, "username": { "type": "keyword", "index": true }, "nickname": { "type": "keyword", "index": true }, "password": { "type": "keyword", "index": false }, "age": { "type": "integer", "index": true }, "info": { "type": "text", "index": true }, "remark": { "type": "text", "index": true } } } }'##参数说明####settings: 设置索引的信息##number_of_shards: 每个索引的主分片数，一旦索引创建后，无法修改此配置##number_of_replicas: 每个主分片的副本数，此配置可随时修改##mappings: 索引映射定义##properties: 字段定义。使用 JSON 配置，键为字段名称（自定义），值为嵌套 JSON，其中 type 指定字段的类型
删除索引
##DSL语法##DELETE /user_info##curl##curl -XDELETE "http://localhost:9200/user_info"
判断索引
##DSL语法##HEAD /user_info## 查看索引是否存在##curl##curl -XHEAD "http://localhost:9200/user_info"## 查看索引是否存在
开关索引
##开启DSL语法##POST /user_info/_open##curlcurl -XPOST "http://localhost:9200/user_info/_open"##关闭 DSL 语法##POST /user_info/_close##curlcurl -XPOST "http://localhost:9200/user_info/_close"
索引别名
##添加别名DSL##POST /user_info/_alias/user1curl -XPOST "http://localhost:9200/user_info/_alias/user1"##删除别名DSL##DELETE /user_info/_alias/user1curl -XDELETE "http://localhost:9200/user_info/_alias/user1"##查看别名DSL##GET /_alias/user1curl -XGET "http://localhost:9200/_alias/useraa"
03
—
mapping操作
查看 mapping
##DSL语法##GET /user_info/_mappingcurl -XGET "http://localhost:9200/user_info/_mapping"
新增mapping
##DSL语法##PUT /user_info/_mapping{"properties":{"sex":{ "type":"keyword" }}}curl -XPUT "http://localhost:9200/user_info/_mapping" -H 'Content-Type: application/json' -d'{ "properties":{ "sex":{ "type":"keyword" } } }'##字段映射只能增加，不能更改删除
04
—
文档操作
添加
POST /user_info/_doc/1{"id":1,"username":"username","password":"123456","nickname":"nickname","age":18,"info":"一些个人相关的介绍","remark":"备注信息","sex":"男"}curl -XPOST "http://localhost:9200/user_info/_doc/1" -H 'Content-Type: application/json' -d'{ "id":1, "username":"username", "password":"123456", "nickname":"nickname", "age":18, "info":"一些个人相关的介绍", "remark":"备注信息", "sex":"男" }'##新增一条数据 - DSL语法
查询指定索引的所有文档
GET /user_info/_search{"query": {"match_all": {}}}curl -XGET "http://localhost:9200/user_info/_search" -H 'Content-Type: application/json' -d'{ "query": { "match_all": {} } }'
通过 id 查询文档
##DSL语法##GET /user_info/_doc/21curl -XGET "http://localhost:9200/user_info/_doc/21"##类似数据库中的 select * from user where id = 21;
模糊查找
GET /user_info/_search{"query": { "match": { "info": "人" } }}
通过条件查询文档
##通过条件查询 - DSL语法##GET /user_info/_search{"query": {"bool": {"must": [ { "term": { "username": "username" } } ]}}}curl -XGET "http://localhost:9200/user_info/_search" -H 'Content-Type: application/json' -d'{ "query": { "bool": { "must": [ { "term": { "username": "username" } } ] } } }'##类似数据库中的 select * from user_info where username = 'username';
范围查找
##DSL语法##GET /user_info/_search{"query": {"range": {"age": {"gt": 23,"lt": 27}}}}curl -XGET "http://localhost:9200/user_info/_search" -H 'Content-Type: application/json' -d'{ "query": { "range": { "age": { "gt": 23, "lt": 27 } } } }'##类似数据库中的范围查询 select * from user_info where age between 23 and 27;
and 查询
##DSL语法##GET /user_info/_search{"query": {"bool": {"must": [{ "range": { "age": { "gt": 23 } } },{ "term": { "sex": "男" } }]}}}curl -XGET "http://localhost:9200/user_info/_search" -H 'Content-Type: application/json' -d'{ "query": { "bool": { "must": [ { "range": { "age": { "gt": 23 } } }, { "term": { "sex": "男" } } ] } } }'##类似数据库中的 and 查询 select * from user_info where age > 23 and sex = '男';
limit 查找
##DSL语法##GET /user_info/_search{"size": 120,"query": {"match_all": {}}}curl -XGET "http://localhost:9200/user_info/_search" -H 'Content-Type: application/json' -d'{ "size": 120, "query": { "match_all": {} } }'##类似数据库中的 limit 查询 select * from user_info limit 120;
or查询
##DSL语法##GET /user_info/_search{"query": {"bool": {"should": [{"range": {"age": { "gt": 18 }}},{"term": { "sex": "女" }}]}}}curl -XGET "http://localhost:9200/user_info/_search" -H 'Content-Type: application/json' -d'{ "query": { "bool": { "should": [ { "range": { "age": { "gt": 18 } } }, { "term": { "sex": "女" } } ] } } }'##类似数据库中的 or 查询 select * from user_info where age > 18 or sex = '男';
limit offset 查找
##DSL语法##GET /user_info/_search{"size": 12,"from": 123,"query": {"match_all": {}}}curl -XGET "http://localhost:9200/user_info/_search" -H 'Content-Type: application/json' -d'{ "size": 12, "from": 123, "query": { "match_all": {} } }'##类似数据库中的 limit 查询 select * from user_info limit 0,10;##参数说明####size: 12 表示我们想要返回的结果数量是12条##from: 123 表示我们想要从结果集中的第123条记录开始返回（因为偏移是从0开始的）##query: {"match_all": {}} 是一个匹配所有文档的查询，因为我们没有特定的查询条件，只是想要分页结果
删除指定ID文档
##DSL语法##DELETE /user_info/_doc/231#删除文档curl -XDELETE "http://localhost:9200/user_info/_doc/231"#删除文档##类似数据库中的 delete 查询 delete from user_info where id = 231;
删除指定条件文档
##DSL语法##POST /user_info/_delete_by_query{"query": {"range": { "age": { "gt": 27 } }}}curl -XPOST "http://localhost:9200/user_info/_delete_by_query" -H 'Content-Type: application/json' -d'{"query":{"range":{"age":{"gt":27}}}}'##类似数据库中的 delete 查询 delete from user_info where age > 27;
注释：如有失误，望批评指正！
后面会写下Windows和liunx的应急响应技巧、容器、还有一些网络安全、数据安全。
后台输入“Windows应急响应手册、linux应急响应手册、数据安全政策、数据安全治理、电力、工业、金融、0731”有相关资料可供下载！
原文作者：老登的安全观；如有侵权，请联系管理员删除。
请登录后发表评论
登录
全部评论
