ES常用命令
GET saasiotalertxx/_search
{
"query": {
"match_all": {}
}
}
GET /saasiotalertx/_mapping
POST saasiotalertxx/_doc/_delete_by_query
{
"query": {"match_all": {}}
}
POST saasiotalertxx/_doc/_delete_by_query
{
"query": {"match_all": {}}
}
get systemoperationlog/_search
{
"query": {
"bool": {
"must": [{
"terms": {
"projectCode": [
"zh_00002_xm_00000001"
],
"boost": 1.0
}
}],
"adjust_pure_negative": true,
"boost": 1.0
}
}
}
}
GET systemoperationlog/_analyze
{
"analyzer": "standard",
"text": "中文"
}
// 删除索引
DELETE /my_index
// 规范化索引 经过查找验证后发现出现该错误是因为5.x之后，Elasticsearch对排序、聚合所依据的字段用单独的数据结构(fielddata)缓存到内存里了，但是在text字段上默认是禁用的，这样做的目的是为了节省内存空间。所以如果需要进行聚合操作，需要单独开启。
PUT myindex/_mapping
{
"properties": {
"city": {
"type": "text",
"fielddata": true
}
}
}
DELETE /saasiotalertx
DELETE /saasiotalertxx
DELETE systemoperationlog
PUT /saasiotalertx
PUT /saasiotalertxx
PUT /systemoperationlog
POST /saasiotalertx/_doc/_mapping?include_type_name=true
{
"properties" : {
"createTime" : {
"type" : "date",
"format" : "yyyy-MM-dd HH:mm:ss"
},
"logId" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ruleId" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"status" : {
"type" : "boolean"
}
}
}
插入数据
POST /saasiotalertxx/_doc
{
"logId" : "07c76ff045d94acaa1c0397027c1eb851659677588848",
"alarmId" : "2558985011638870017",
"status" : true,
"content" : "动作类型：生成告警视频&监控设备数量：1&监控设备：球机",
"title" : "执行动作1",
"createTime" : "2022-08-18 09:12:49"
}
