Elasticsearch 是一个分布式、RESTful 风格的搜索和数据分析引擎，能够解决不断涌现出的各种用例。 作为 Elastic Stack 的核心，它集中存储您的数据，帮助您发现意料之中以及意料之外的情况。

安装

  • Installing Marvel
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

#Step 1: Install Marvel into Elasticsearch:
bin/plugin install license
bin/plugin install marvel-agent

#Step 2: Install Marvel into Kibana
bin/kibana plugin --install elasticsearch/marvel/latest

#Step 3: Start Elasticsearch and Kibana
bin/elasticsearch
bin/kibana

#Step 4: Navigate to http://localhost:5601/app/marvel
  • Installing Marvel on Offline Machines 离线安装
1
2
3

bin/plugin install file:///Data/tgz/license-2.3.3.zip
bin/plugin install file:///Data/tgz/marvel-agent-2.3.3.zip
bin/kibana plugin --install marvel --url file:///Data/tgz/marvel-2.3.3.tar.gz

启动

1
2

bin/elasticsearch
bin/kibana

索引

  • 创建索引
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

curl -XPUT 'http://localhost:9200/megacorp/employee/1' -d '
{
    "first_name" : "John",
    "last_name" :  "Smith",
    "age" :        25,
    "about" :      "I love to go rock climbing",
    "interests": [ "sports", "music" ]
}'

curl -XPUT 'http://localhost:9200/megacorp/employee/2' -d '
{
    "first_name" :  "Jane",
    "last_name" :   "Smith",
    "age" :         32,
    "about" :       "I like to collect rock albums",
    "interests":  [ "music" ]
}'

curl -XPUT 'http://localhost:9200/megacorp/employee/3' -d '
{
    "first_name" :  "Douglas",
    "last_name" :   "Fir",
    "age" :         35,
    "about":        "I like to build cabinets",
    "interests":  [ "forestry" ]
}'
  • 检索文档
1

curl -XGET 'http://localhost:9200/megacorp/employee/1?pretty'
  • 简单搜索
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

# 搜索全部员工
curl -XGET 'http://localhost:9200/megacorp/employee/_search?pretty'

# 搜索last_name包含"Smith"的记录
# 使用查询字符串搜索
curl -XGET 'http://localhost:9200/megacorp/employee/_search?pretty&q=last_name:Smith'

# 使用DSL语句查询
curl -XGET 'http://localhost:9200/megacorp/employee/_search?pretty' -d '
{
    "query" : {
        "match" : {
            "last_name" : "Smith"
        }
    }
}'

# 使用DSL语句查询 更复杂的搜索
curl -XGET 'http://localhost:9200/megacorp/employee/_search?pretty' -d '
{
    "query" : {
        "filtered" : {
            "filter" : {
                "range" : {
                    "age" : { "gt" : 30 }
                }
            },
            "query" : {
                "match" : {
                    "last_name" : "smith"
                }
            }
        }
    }
}'
  • 全文搜索
1
2
3
4
5
6
7
8

curl -XGET 'http://localhost:9200/megacorp/employee/_search?pretty' -d '
{
    "query" : {
        "match" : {
            "about" : "rock climbing"
        }
    }
}'
  • 短语搜索
1
2
3
4
5
6
7
8
9

#  查询同时包含"rock"和"climbing"（并且是相邻的）的员工记录
curl -XGET 'http://localhost:9200/megacorp/employee/_search?pretty' -d '
{
    "query" : {
        "match_phrase" : {
            "about" : "rock climbing"
        }
    }
}'
  • 高亮搜索结果
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

#  查询同时包含"rock"和"climbing"（并且是相邻的）的员工记录,并返回高亮片段
curl -XGET 'http://localhost:9200/megacorp/employee/_search?pretty' -d '
{
    "query" : {
        "match_phrase" : {
            "about" : "rock climbing"
        }
    },
    "highlight": {
        "fields" : {
            "about" : {}
        }
    }
}'

分析

  • 聚合
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

#  按兴趣
curl -XGET 'http://localhost:9200/megacorp/employee/_search?pretty' -d '
{
  "aggs": {
    "all_interests": {
      "terms": { "field": "interests" }
    }
  }
}'

#  统计每种兴趣的平均年龄
curl -XGET 'http://localhost:9200/megacorp/employee/_search?pretty' -d '
{
    "aggs" : {
        "all_interests" : {
            "terms" : { "field" : "interests" },
            "aggs" : {
                "avg_age" : {
                    "avg" : { "field" : "age" }
                }
            }
        }
    }
}'

2022-02-19 Homestead 安装 7.16.0

安装IK中文分词

1
2
3

$ /usr/share/elasticsearch

$ sudo bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v7.16.0/elasticsearch-analysis-ik-7.16.0.zip

ik提供了两个分词器，分别是 ik_max_word 和 ik_smart ，下面我们分别测试下。 先测试 ik_max_word ，输入命令如下：

1
2
3
4
5

POST http://192.168.10.10:9200/_analyze
{  
    "analyzer": "ik_max_word",
    "text": "世界如此之大"  
}

响应结果如下：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

{
    "tokens": [
        {
            "token": "世界",
            "start_offset": 0,
            "end_offset": 2,
            "type": "CN_WORD",
            "position": 0
        },
        {
            "token": "如此之",
            "start_offset": 2,
            "end_offset": 5,
            "type": "CN_WORD",
            "position": 1
        },
        {
            "token": "如此",
            "start_offset": 2,
            "end_offset": 4,
            "type": "CN_WORD",
            "position": 2
        },
        {
            "token": "之大",
            "start_offset": 4,
            "end_offset": 6,
            "type": "CN_WORD",
            "position": 3
        }
    ]
}

再测试 ik_smart ，输入命令如下：

1
2
3
4
5

POST http://192.168.10.10:9200/_analyze
{  
    "analyzer": "ik_smart",
    "text": "世界如此之大"  
}

响应结果如下：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

{
    "tokens": [
        {
            "token": "世界",
            "start_offset": 0,
            "end_offset": 2,
            "type": "CN_WORD",
            "position": 0
        },
        {
            "token": "如此",
            "start_offset": 2,
            "end_offset": 4,
            "type": "CN_WORD",
            "position": 1
        },
        {
            "token": "之大",
            "start_offset": 4,
            "end_offset": 6,
            "type": "CN_WORD",
            "position": 2
        }
    ]
}

遇到的问题

外网访问，修改 network.host: 0.0.0.0 配置项后启动失败

启动

1

systemctl start elasticsearch.service

查看状态信息

1

systemctl status elasticsearch.service

查看日志，找出错误原因

1

tail -f /var/log/elasticsearch/homestead.log

ElasticSearch启动过程错误：org.elasticsearch.transport.BindTransportException: Failed to bind to [9300-9400]

查看本机IP ip addr，将 netword.host 改为 192.168.10.10，重新启动成功。