Elasticsearch 完全指南：从原理到实战的全面教程

正向索引：文档1 → [苏州街, 维亚大厦]
倒排索引：苏州街 → [文档1, 文档2]
         维亚大厦 → [文档1]
         桔子酒店 → [文档2]

# 单节点启动
docker run -d --name elasticsearch \
  -p 9200:9200 -p 9300:9300 \
  -e "discovery.type=single-node" \
  -e "xpack.security.enabled=false" \
  -e "ES_JAVA_OPTS=-Xms512m -Xmx512m" \
  elasticsearch:8.13.0

version: '3.8'
services:
  elasticsearch:
    image: elasticsearch:8.13.0
    container_name: elasticsearch
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
      - ES_JAVA_OPTS=-Xms1g -Xmx1g
    ports:
      - "9200:9200"
      - "9300:9300"
    volumes:
      - es_data:/usr/share/elasticsearch/data

  kibana:
    image: kibana:8.13.0
    container_name: kibana
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    ports:
      - "5601:5601"
    depends_on:
      - elasticsearch

volumes:
  es_data:

cluster.name: my-cluster
node.name: node-1
network.host: 0.0.0.0
http.port: 9200
discovery.seed_hosts: ["node-1", "node-2", "node-3"]
cluster.initial_master_nodes: ["node-1"]

# 内存锁定（避免 swap）
bootstrap.memory_lock: true

# 检查集群状态
curl http://localhost:9200/_cluster/health?pretty

# 查看节点信息
curl http://localhost:9200/_cat/nodes?v

# 查看所有索引
curl http://localhost:9200/_cat/indices?v

# 指定 ID
PUT /my-index/_doc/1
{
  "name": "张三",
  "age": 25,
  "email": "zhangsan@example.com"
}

# 自动生成 ID
POST /my-index/_doc
{
  "name": "李四",
  "age": 30
}

GET /my-index/_doc/1

# 只返回指定字段
GET /my-index/_doc/1?_source=name,email

# 全量更新（覆盖）
PUT /my-index/_doc/1
{
  "name": "张三",
  "age": 26
}

# 部分更新
POST /my-index/_update/1
{
  "doc": {
    "age": 26
  }
}

DELETE /my-index/_doc/1

POST _bulk
{"index": {"_index": "my-index", "_id": "3"}}
{"name": "王五", "age": 28}
{"index": {"_index": "my-index", "_id": "4"}}
{"name": "赵六", "age": 32}
{"update": {"_index": "my-index", "_id": "1"}}
{"doc": {"age": 27}}
{"delete": {"_index": "my-index", "_id": "2"}}

PUT /products
{
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1
  },
  "mappings": {
    "properties": {
      "name": {
        "type": "text",
        "analyzer": "ik_max_word",
        "search_analyzer": "ik_smart",
        "fields": {
          "keyword": { "type": "keyword" }
        }
      },
      "price": { "type": "double" },
      "category": { "type": "keyword" },
      "tags": { "type": "keyword" },
      "createTime": {
        "type": "date",
        "format": "yyyy-MM-dd HH:mm:ss"
      },
      "isActive": { "type": "boolean" }
    }
  }
}

# 创建新索引
PUT /new-index
{ "mappings": { ... } }

# 迁移数据
POST _reindex
{
  "source": { "index": "old-index" },
  "dest": { "index": "new-index" }
}

# 切换别名
POST _aliases
{
  "actions": [
    { "remove": { "index": "old-index", "alias": "my-alias" } },
    { "add": { "index": "new-index", "alias": "my-alias" } }
  ]
}

GET /my-index/_search
{
  "query": { "match_all": {} },
  "from": 0,
  "size": 10,
  "sort": [{ "createTime": { "order": "desc" } }]
}

# 单字段匹配
GET /my-index/_search
{
  "query": {
    "match": { "name": "苹果手机" }
  }
}

# 短语匹配（不分词，整体匹配）
GET /my-index/_search
{
  "query": {
    "match_phrase": { "name": "苹果手机" }
  }
}

# 多字段匹配
GET /my-index/_search
{
  "query": {
    "multi_match": {
      "query": "苹果",
      "fields": ["name^3", "description"]
    }
  }
}

# keyword 字段精确匹配
GET /my-index/_search
{
  "query": {
    "term": { "category": "电子产品" }
  }
}

GET /my-index/_search
{
  "query": {
    "range": {
      "price": {
        "gte": 100,
        "lte": 500
      }
    }
  }
}

GET /my-index/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "name": "手机" } }
      ],
      "filter": [
        { "term": { "category": "电子产品" } },
        { "range": { "price": { "gte": 1000, "lte": 5000 } } }
      ],
      "must_not": [
        { "term": { "isActive": false } }
      ],
      "should": [
        { "term": { "tags": "热销" } }
      ]
    }
  }
}

# 通配符查询
{ "wildcard": { "name": "苹果*" } }

# 模糊查询（容错）
{ "fuzzy": { "name": "苹果" } }

# 前缀查询
{ "prefix": { "name": "苹果" } }

# 字段存在查询
{ "exists": { "field": "email" } }

# ID 查询
{ "ids": { "values": ["1", "2", "3"] } }

# 按字段分组
GET /my-index/_search
{
  "size": 0,
  "aggs": {
    "by_category": {
      "terms": { "field": "category", "size": 10 }
    }
  }
}

# 按日期分桶
GET /my-index/_search
{
  "size": 0,
  "aggs": {
    "by_month": {
      "date_histogram": {
        "field": "createTime",
        "calendar_interval": "month"
      }
    }
  }
}

# 范围分桶
GET /my-index/_search
{
  "size": 0,
  "aggs": {
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          { "to": 100 },
          { "from": 100, "to": 500 },
          { "from": 500 }
        ]
      }
    }
  }
}

# 统计聚合
GET /my-index/_search
{
  "size": 0,
  "aggs": {
    "price_stats": { "stats": { "field": "price" } },
    "price_avg": { "avg": { "field": "price" } },
    "price_sum": { "sum": { "field": "price" } },
    "unique_categories": { "cardinality": { "field": "category" } }
  }
}

# 按类别分组，计算每组的平均价格和最高价格
GET /my-index/_search
{
  "size": 0,
  "aggs": {
    "by_category": {
      "terms": { "field": "category", "size": 10 },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } },
        "max_price": { "max": { "field": "price" } }
      }
    }
  }
}

原始文本 → [字符过滤器] → [分词器] → [分词过滤器] → 词项输出

# 测试分词
POST _analyze
{
  "analyzer": "ik_smart",
  "text": "中华人民共和国国歌"
}
# 结果：中华人民共和国 / 国歌

POST _analyze
{
  "analyzer": "ik_max_word",
  "text": "中华人民共和国国歌"
}
# 结果：中华人民共和国 / 中华人民共和 / 中华 / 人民共和国 / 人民 / 共和国 / 共和 / 国歌

PUT /my-index
{
  "settings": {
    "analysis": {
      "analyzer": {
        "my_analyzer": {
          "type": "custom",
          "char_filter": ["html_strip"],
          "tokenizer": "standard",
          "filter": ["lowercase", "stop", "snowball"]
        }
      }
    }
  }
}

# 创建别名
POST _aliases
{
  "actions": [
    { "add": { "index": "my-index-v1", "alias": "my-index" } }
  ]
}

# 零停机切换索引
POST _aliases
{
  "actions": [
    { "remove": { "index": "my-index-v1", "alias": "my-index" } },
    { "add": { "index": "my-index-v2", "alias": "my-index" } }
  ]
}

PUT _index_template/logs-template
{
  "index_patterns": ["logs-*"],
  "template": {
    "settings": {
      "number_of_shards": 3,
      "number_of_replicas": 1
    },
    "mappings": {
      "properties": {
        "timestamp": { "type": "date" },
        "message": { "type": "text" },
        "level": { "type": "keyword" }
      }
    }
  }
}

PUT _ilm/policy/logs-policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size": "50GB",
            "max_age": "1d"
          }
        }
      },
      "warm": {
        "min_age": "7d",
        "actions": {
          "shrink": { "number_of_shards": 1 },
          "forcemerge": { "max_num_segments": 1 }
        }
      },
      "delete": {
        "min_age": "30d",
        "actions": { "delete": {} }
      }
    }
  }
}

# 堆内存：Min(节点内存/2, 32GB)
ES_JAVA_OPTS=-Xms16g -Xmx16g

# 关闭 swap
bootstrap.memory_lock: true

# 最大文件句柄数
ulimit -n 65535

热数据（最近 7 天）→ SSD 节点 → 高性能查询
温数据（7-30 天）  → HDD 节点 → force_merge + shrink
冷数据（>30 天）   → 归档/删除 → ILM 自动管理

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-elasticsearch</artifactId>
</dependency>

spring:
  elasticsearch:
    uris: localhost:9200
    username: elastic
    password: changeme

@Data
@Document(indexName = "products")
public class Product {
    @Id
    private String id;

    @MultiField(
        mainField = @Field(type = FieldType.Text, analyzer = "ik_max_word", searchAnalyzer = "ik_smart"),
        otherFields = @InnerField(suffix = "keyword", type = FieldType.Keyword)
    )
    private String name;

    @Field(type = FieldType.Text, analyzer = "ik_max_word")
    private String description;

    @Field(type = FieldType.Double)
    private BigDecimal price;

    @Field(type = FieldType.Keyword)
    private String category;

    @Field(type = FieldType.Date, format = DateFormat.date_hour_minute_second)
    private LocalDateTime createTime;
}

@Repository
public interface ProductRepository extends ElasticsearchRepository<Product, String> {
    List<Product> findByName(String name);
    List<Product> findByCategory(String category);
    List<Product> findByPriceBetween(BigDecimal min, BigDecimal max);
    Page<Product> findByCategory(String category, Pageable pageable);
}

// 替代已废弃的 RestHighLevelClient
ElasticsearchClient client = new ElasticsearchClient(
    new ElasticsearchTransport(
        new RestClientTransport(
            RestClient.builder(new HttpHost("localhost", 9200)),
            new JacksonJsonpMapper()
        )
    )
);

// 复杂查询
SearchResponse<Product> response = client.search(s -> s
    .index("products")
    .query(q -> q.bool(b -> b
        .must(m -> m.match(mt -> mt.field("name").query("手机")))
        .filter(f -> f.term(t -> t.field("category").value("电子产品")))
        .filter(f -> f.range(r -> r.field("price").gte(JsonData.of(1000))))
    ))
    .from(0).size(10),
    Product.class
);

应用日志 → Filebeat → Logstash → Elasticsearch → Kibana
               ↓
         过滤、转换、富化

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/*.log

output.logstash:
  hosts: ["localhost:5044"]

input {
  beats { port => 5044 }
}

filter {
  grok { match => { "message" => "%{COMBINEDAPACHELOG}" } }
  date { match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ] }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "logs-%{+YYYY.MM.dd}"
  }
}