用到的Elasticsearch相关的笔记

一. 安装elasticsearch

1.安装java
wget -O jdk-8u111-linux-x64.tar.gz url(去官网搜)
tar zxvf jdk-8u111-linux-x64.tar.gz
配置环境变量
vi ~/.bashrc
export JAVA_HOME=/home/download/jdk1.8.0_111


export JAVA_BIN=$JAVA_HOME/bin


export JAVA_LIB=$JAVA_HOME/lib


export CLASSPATH=.:$JAVA_LIB/tools.jar:$JAVA_LIB/dt.jar


export PATH=$JAVA_BIN:$PATH

使jdk环境变量生效，source ~/.bashrc

2.安装elasticsearch
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.0.1.zip
unzip elasticsearch-5.0.1.zip
更改配置文件
cd /home/elasticsearch-5.0.1/config
vi elasticsearch.yml
添加：
logs目录(权限)
data目录(权限)
network.host:0.0.0.0
vi /etc/security/limits.conf 


添加如下内容:


* soft nofile 65536


* hard nofile 131072


* soft nproc 2048


* hard nproc 4096


vi /etc/sysctl.conf 


添加下面配置：


vm.max_map_count=655360


并执行命令：


sysctl -p

二. 使用

1. 新建index
curl -XPUT 'localhost:9200/test_table?pretty'

2. 查询所有index 列表
curl 'localhost:9200/_cat/indices?v'

3.  插入数据
curl -XPUT 'localhost:9200/test_table/data/3?pretty' -d '
{
  "param_1": "yan_1",
  "param_2": "yan_2"
}'

4.  根据ID查询
curl 'localhost:9200/acs_acstacacsaccounting/data/3?pretty'

5. 删除index
curl -XDELETE 'localhost:9200/acstacacsauthentication-2016?pretty'

6. 修改数据(会直接替换原有数据)
curl -XPUT 'localhost:9200/test_table/data/3?pretty' -d '
{
  "name": "John Doe",
  "param_1": "yan_Doe"
}'

7. 略复杂的查询

1) 单条件，有时间范围，按照字段排序

curl -XGET'localhost:9200/acs_sysstatus-2016/_search?pretty' -d '

{

   "query": {

     "bool": {

     "must": { "match": {"ACSServer":"ACS-2"} },

     "filter": {

       "range": {

         "ACSTimestamp": {

           "gte": "now-2d",

           "lt": "now"

         }

       }

     }

    }

   },"size":"5",

    "sort": [

       { "ACSTimestamp" : {"order" : "desc"}}

    ]

}'

2) 多条件

curl -XGET'localhost:9200/acstacacsauthentication-2016/_search?pretty' -d '

{

   "query": {

     "bool": {

     "must": [{ "match": {"RemoteAddress":"10.79.148.192"} },

      { "match": {"DeviceIPAddress": "10.79.148.211"} },

      { "match": {"UserName": "root"} },{"match": {"Failed": true} }

      ],

     "filter": {

       "range": {

         "ACSTimestamp": {

           "gte": "2016-07-11T19:40:42",

           "lt": "2016-12-20T19:40:42"

         }

       }

     }

    }

    },"size":"5",

    "sort": [

       { "ACSTimestamp" : {"order" : "desc"}}

    ]

}'