, add the _search keyword after the url to indicate the search request, such as: GET /megacorp/employee/_search
Add the parameter of q after the ? to pass in the search parameter, such as: GET /megacorp/employee/_search?q=id :123
pretty keyword: add ?pretty after the url request (add &pretty when there is already a question mark), you can format the response result
http://192.168.23.163:9200/megacorp/employee/_search?q=id:582&pretty
Response result:
{
"took" : 3, //Search time, in milliseconds
"timed_out" : false, //whether it times out
"_shards" : { //Query shards
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 1, //total
"max_score" : 3.3513753, //Maximum correlation score
"hits" : [ { //Query result
"_index" : "megacorp", //where the index
"_type" : "employee", //the category it belongs to
"_id" : "582", //id
"_score" : 3.3513753, //The correlation score of the current data
"_source" : { //Query content
"id" : 582,
"type" : "120",
...
"keywords" : "HAMADA,RISDON,Dangerous"
}
} ]
}
}
Structured query
Some complex queries cannot pass parameters directly through the url. It can pass the parameters in the request body in JSON format. Since GET requests are not widely supported, they can also be passed through POST requests
through a simple query. To understanding:
GET /_search
{
"query": { // represents a structured query
"match": { // query method, match query
"tweet": "elasticsearch" // field name: query content
}
}
}
All query request urls must end with /_search (not counted after ?), and structured queries use query as the root key (requests in the following introduction are all content in query).
Query and filter
query and filter statement are very different similar, but they are slightly different due to the purpose of use
- A filter statement that asks each document if the field value contains a specific value
- A query statement is similar to a filter statement, except that the query statement asks each document how well a field value matches a specific value
All in all, the main difference is that the filter conditions do not affect the relevance score, while the query statement will affect the relevance score.
In addition , the filter statement will be cached, and the query efficiency of the cached filter statement is far better than that of a query statement. Therefore, except for those that need to calculate the relevance score, the filter statement should be used for others.
The keywords of the filter statement are: bool, term, terms, range, exists, missing, etc. The keywords of the
query statement are: bool, match_all, match, multi_match, etc. The following will introduce the
bool filter
one by one. The bool filter can be used to combine multiple Boolean logic for filtering query results, which includes the following operators:
must :: Exact match of multiple query conditions, equivalent to and
must_not :: Inverse matching of multiple query conditions, equivalent to not
should :: At least one query condition Match, equivalent to or
These parameters can inherit a filter condition or an array of filter conditions respectively
{
"bool": {
"must": { "term": { "folder": "inbox" }},
"must_not": { "term": { "tag": "spam" }},
"should": [
{ "term": { "starred": true }},
{ "term": { "unread": true }}
]
}
}
term filter
term is mainly used to match exactly which values, such as numbers, dates, booleans or not_analyzed strings (unanalyzed text data types)
{ "term": { "age": 26 }}
{ "term": { "date": "2014-09-01" }}
{ "term": { "public": true }}
{ "term": { "tag": "full_text" }}
terms filter
terms are somewhat similar to terms, but terms allow multiple matching conditions to be specified. If a field specifies multiple values, the documents need to be matched together
{
"terms": {
"tag": [ "search", "full_text", "nosql" ]
}
}
range filtering
range filtering allows us to find a batch of data according to a specified range
{
"range": {
"age": {
"gte": 20,
"lt": 30
}
}
}
gt :: greater than
gte :: greater than or equal to
lt :: less than
lte :: less than or equal to
exists and missing filtering
exists and missing filtering can be used to find whether a document contains a specified field or does not have a certain field, similar to the IS_NULL condition in a SQL statement
{
"exists": {
"field": "title"
}
}
match_all query
Use match_all to query all documents, which is the default statement without query conditions
{
"match_all": {}
}
match query
match query is a standard query, whether you need full text query or exact query basically use it.
If you use match to query a full text field, it will use the parser to parse the match query characters before actually querying
{
"match": {
"tweet": "About Search"
}
}
If you specify an exact value with match, it will search for the value you give when it encounters a number, date, boolean or not_analyzed string:
{ "match": { "age": 26 }}
{ "match": { "date": "2014-09-01" }}
{ "match": { "public": true }}
{ "match": { "tag": "full_text" }}
Tip: When doing an exact match search, you'd better use a filter term (term), because the filter term can cache the data.
multi_match query
multi_match query allows you to specify multiple search fields when doing a match query
{
"multi_match": {
"query": "full text search",
"fields": [ "title", "body" ]
}
}
bool query
bool query is similar to bool filter, used to combine multiple query clauses. The difference is that the bool filter can directly give whether the match is successful, and the bool query needs to calculate the _score (relevance score) of each query clause.
must:: The query specifies that the document must be included.
must_not:: The query specifies that the document must not be included.
should:: Query the specified document, if there is, you can add points to the relevance of the document.
The following query will find that the title field contains "how to make millions" and the "tag" field is not marked as spam. These matching documents will be ranked higher than similar sites if they are identified as "starred" or published before 2014
{
"bool": {
"must": { "match": { "title": "how to make millions" }},
"must_not": { "match": { "tag": "spam" }},
"should": [
{ "match": { "tag": "starred" }},
{ "range": { "date": { "gte": "2014-01-01" }}}
]
}
}
Filtered queries
The search API can only contain query statements, so we need to use filtered to include both "query" and "filter" clauses
{
"query": {
"filtered": {
"query": { "match": { "email": "business opportunity" }},//查询
"filter": { "term": { "folder": "inbox" }} //过滤
}
}
}
To understand the query statement
and want to know the specific error message that the statement is illegal, you need to add the explain parameter, similar to the explain of sql
GET /gb/tweet/_validate/query?explain
{
"query": {
"tweet" : {
"match" : "really powerful"
}
}
}
Use sql query
reference: https://github.com/NLPchina/elasticsearch-sql
can execute sql online: http://192.168.23.163:9200/_plugin/sql/