# 创建索引
PUT indexname

# 给索引添加映射
PUT /index/fulltext/_mapping
{
  "properties": {
    "content": {
      "type": "text",
      "analyzer": "ik_smart",
      "search_analyzer": "ik_smart"
    }
  }
}

# search 搜索所有
POST sougoulog/_search
{
  "query": {
    "match_all": {}
  },
  "from": 0,
  "size": 10
}

POST _all/_search
{
  "query": {
    "match": {
      "keywords": {
        "query": "无",
        "operator": "and",
        "boost": 2
        }
    }
  },
  "from": 0,
  "size": 115
}

# query_string多字段搜索
POST sougoulog/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "美国",
            "analyzer": "ik_smart",
            "default_operator": "OR", 
            "fields": [
              "userid",
              "keywords",
              "url"
            ]
          }
        },
        {
          "range": {
            "visittime": {
              "gte": "00:00:10",
              "lte": "00:55:55"
            }
          }
        },
        {
          "term": {
            "userid": {
              "value": "09215584418987899"
            }
          }
        },
        {
          "fuzzy": {
            "userid": {
              "value": "092155844189878"
            }
          }
        }
      ]
    }
  },
  "from": 0,
  "size": 10
}
# 模糊搜索
POST sougoulog/_search
{
  "query": 
    {
      "fuzzy": {
        "userid": {
          "value": "007177259245828"
        }
      }
    },
  "from": 0,
  "size": 10
}

# 经纬度搜索
POST shop/_search
{
  "query": {
    "geo_distance": {
      "distance": "100km",
      "location": {
        "lat": 39.96820,
        "lon": 116.4107
      }
    }
  }
}
#布尔查询，可根据多条件搜索，取代以前的过滤功能
POST sougoulog/_search
{
  "query": 
    {
      "bool": {
      "must": [
        { 
          "match": {
            "keywords": "美国"
          }
        },
        {
          "range": {
            "rank": {
              "gte": 5,
              "lte": 20
            }
          }
        }
      ]
    
    }
  }, 
  "from": 0,
  "size": 115
}

# 使用后过滤器post_filter对查询结果进行条件筛选，只影响显示、不影响聚集结果
POST sougoulog/_search
{
  "query": {
    "multi_match": {
      "query": "全国美国",
      "analyzer": "ik_smart", 
      "fields": ["userid","url","keywords"]
    }
  }, 
  "post_filter": {
    "range": {
      "rank": {
        "gte": 3
      }
    }
  }, 
  "from": 0,
  "size": 115
}

# analyze
POST sougoulog/_analyze
{"analyzer" : "standard",  "text" : "国无"}

POST sougoulog/_analyze
{"analyzer" : "ik_max_word",  "text" : "中华人民共和国"}

POST sougoulog/_analyze
{"analyzer" : "ik_smart",  "text" : "中华人民共和国治安管理处罚法"}

# 查询一个文档的词条向量
POST sougoulog/docs/35/_termvectors
{
  "fields" : ["keywords","userid"],
  "offsets" : true,
  "payloads" : true,
  "positions" : true,
  "term_statistics" : true,
  "field_statistics" : true
}

# aggregations
# 度量聚集，查看统计数据
POST sougoulog/_search
{
  "query": {
    "match_all": {}
  },
  "from": 0,
  "size": 0,
  "aggs":{
    "countnumber":{
    "stats": {
      "field": "rank"
    }
    }
    
  }
}
# terms词条聚集，相当于在字段上group by，不能用于有分词字段的统计
POST sougoulog/_search
{
  "query": {
    "match_all": {}
  },
  "from": 0,
  "size": 0,
  "aggs":{
    "countnumber":{
      "terms": {
                "field": "visittime" ,
                "size": 100 ,
                "order": {
                  "_term": "asc"
                }
      
      },
      "aggs": {  
                "sum_rank": {
                    "stats": {
                        "field": "rank"
                    }
                }
      }
    }
  }
}
# 时间范围聚集date_range，区间左闭右开
POST sougoulog/_search
{
  "query": {
    "match_all": {}
  },
  "from": 0,
  "size": 0,
  "aggs":{
    "countnumber":{
      "date_range": {
                "field": "visittime" ,
                "ranges": [
                  {
                    "to":"00:03:00"
                  },{
                    "from": "00:03:00",
                    "to":"00:06:00"
                  },{
                    "from": "00:06:00",
                    "to":"00:09:00"
                  },
                  {
                    "from": "00:09:00"
                  }
                ]
      }
    }
  }
}
# 直方图聚集，直接传步长，不需要传区间段，interval单位是毫秒
POST sougoulog/_search
{
  "query": {
    "match_all": {}
  },
  "from": 0,
  "size": 0,
  "aggs":{
    "countnumber":{
      "histogram": {
                "field": "visittime" ,
                "interval": 180000
      }
    }
  }
}
# 日期直方图聚集，直接传步长，不需要传区间段，interval单位是分钟
POST sougoulog/_search
{
  "query": {
    "match_all": {}
  },
  "from": 0,
  "size": 0,
  "aggs":{
    "countnumber":{
      "date_histogram": {
                "field": "visittime" ,
                "interval": "3m"
      }
    }
  }
}
# 嵌套聚集，top_hits用于返回父聚集的前N名
POST sougoulog/_search
{
  "query": {
    "match_all": {}
  },
  "from": 0,
  "size": 0,
  "aggs":{
    "countnumber":{
      "date_histogram": {
                "field": "visittime" ,
                "interval": "3m"
      },
      "aggs":{
        "details":{
          "top_hits": {
            "size": 3,
            "sort": [{
              "visittime": {
                "order": "asc"
              }
            }]
          }
        }
      }
    }
  }
}

# sql查询
POST _xpack/sql?format=txt
{
  "query": "select * from sougoulog where id=100"
}

# 集群状态
GET _cluster/state

GET _nodes/stats

GET _cat/nodes

GET _cat/allocation?v