文章目錄

• • 1. node setting
  • 2. parent/child 文檔
  • • 1. nested相關(guān)
    • 2. join類型設(shè)置
  • 3. query查詢
  • • 1. 簡單高亮
    • 2. 模糊查詢
    • 3. multi_match查詢
    • 4. 打分查詢
    • 5. alias設(shè)置查詢
    • 6. bool 查詢
    • 7. 多個(gè)索引同一個(gè)alias,只有一個(gè)index可以寫入
    • 8. scroll query
  • 4. 同義搜索
  • • 1. 題目一 we-do 等同于wedo
    • 2. 題目二，dingding搜索
    • 3. 題目三 dog & cat搜索
  • 5. multi_fields
  • • 1. 題目一： 多字段不同analyzer
    • 2. 題目二： 多字段不同analyzer
  • 6. dynamic_template
  • 7. date_range_and_count.txt
  • 8. aggregation search
  • • 1. 題目一：地震數(shù)據(jù)按月最大最小
    • 2. 題目二： 地震數(shù)據(jù)聚合結(jié)果過濾過濾
    • 3. 題目三:bucket agg之間的嵌套
    • 4. 題目四：生產(chǎn)商排名
  • 9. snapshot_and_restore
  • 10. search_template
  • 11. update_by_query
  • • 1. 題目一：內(nèi)容join
    • 2. 題目二：query過濾+script設(shè)置字段值
  • 12. reindex pipeline_use
  • • 1. 題目一 字段分割，去除空格，統(tǒng)計(jì)長度
    • 2. 題目二，字段拼接，字符串長度
  • 13. allocation filter
  • • 1. 題目一： 冷熱架構(gòu)
    • 2. 題目二：機(jī)架感知
    • 3. 題目三： 集群去除node, index去除node
  • 14. cross cluster search
  • 15. 截圖真題

個(gè)人搜集的es練習(xí)題

1. node setting

集群的cluster name設(shè)置， 集群的角色設(shè)置，集群的attr設(shè)置
今天又看了視頻才發(fā)現(xiàn)還是有很多地方?jīng)]有注意到位啊

## cluster,node基礎(chǔ)設(shè)置 cluster.name: log-dev node.name: node-2## node角色配置相關(guān)的有4個(gè) node.master: true node.data: true node.ingest: true node.ml: false ## master一般不允許遠(yuǎn)程進(jìn)行連接，非master節(jié)點(diǎn)可以不配置 cluster.remote.connect: false# 單機(jī)配置snapshot的倉庫地址 path.repo: ["/home/deploy/search/log-manager/elasticsearch-7.2.0/repository01"]# 這個(gè)可以直接配置成 _site_ 就代表會綁定本機(jī)的內(nèi)網(wǎng)地址，考試中應(yīng)該也不用修改 network.host: 19.76.3.145# 默認(rèn)值就是9200，考試中好像沒有設(shè)置 http.port: 12200# 考試中好像沒有設(shè)置 transport.port: 12300# seed_hosts也可以直接設(shè)置ip,那么默認(rèn)會加上transport.port discovery.seed_hosts: ["19.76.0.98:12300", "19.76.3.145:12300","19.76.0.129:12300"]# 這個(gè)是master的node name構(gòu)成 cluster.initial_master_nodes: ["node-1", "node-2","node-3"] bootstrap.system_call_filter: false## data log 存儲地址配置，考試中一般不需要特別關(guān)注 path.data: /home/deploy/search/log-manager/elasticsearch-7.2.0/data path.logs: /home/deploy/search/log-manager/elasticsearch-7.2.0/logs# reindex 從其他集群的時(shí)候這里需要配置其他集群的地址 reindex.remote.whitelist: "19.76.0.27:14200,19.76.0.98:14200, 19.76.3.145:14200, 19.76.0.129:14200"# node attr的設(shè)置 node.attr.size: small node.attr.rack: rack01 node.attr.disk: big node.attr.machine: m01

2. parent/child 文檔

1. nested相關(guān)

POST phone/_doc/1 {"brand": "samsung","model": "AS1","features": [{"type": "os","value": "android"},{"type": "memory","value": "100`"},{"type": "capacity","value": "128"}] } POST phone/_doc/2 {"brand": "apple","model": "AS2","features": [{"type": "os","value": "apple"},{"type": "memory","value": "32"},{"type": "capacity","value": "100"}] }

使用類似下面的查詢，結(jié)果是只能查出來一條數(shù)據(jù)

GET phone/_search {"query": {"bool": {"must": [{"match": {"features.type": "memory"}},{"match": {"features.value": "100"}}]}} }

2. join類型設(shè)置

{"title":"elastic","content":"ELK is a great tool" }{"comments":"good blogs"}

上面的兩個(gè)doc，一個(gè)是article，一個(gè)是該article的comment，把這兩個(gè)存入同一個(gè)index當(dāng)中

PUT join_test03 {"mappings": {"properties": {"title": {"type": "text"},"content": {"type": "text"},"comments": {"type": "text"},"relation": {"type": "join","relations": { # 注意這個(gè)地方是固定的，別忘了"article": "comment"}}}} } PUT join_test03/_doc/1 {"title": "elastic","content": "ELK is a great tool","relation": { #這個(gè)字段使用嵌套結(jié)構(gòu)"name": "article"} }PUT join_test03/_doc/2?routing=1 {"comments":"good blogs","relation":{"name":"comment","parent":1 # 直接是parent} }測試GET join_test03/_search {"query": {"has_child": {"type": "comment","query": {"match": {"comments": "good"}}}} }

3. query查詢

1. 簡單高亮

PUT query_highlight/_doc/1 {"title":"ther beautifull door is yours","body":"i want to be a better man to left the door " } PUT query_highlight/_doc/2 {"title":"do you like dog?","body":"the dog is a good friend more than a pet " }

在查詢title字段中存在door的doc，并進(jìn)行高亮

GET query_highlight/_search {"query": {"match": {"title": "door"}},"highlight": {"fields": {"title": {"pre_tags": ["<em>"],"post_tags": ["</em>"]},"body": {} #這里的查詢沒有效果}} }

感覺必須是指定字段才行了

2. 模糊查詢

如果要進(jìn)行編輯距離，即使是近似door的也要能夠查出來,下面的是編輯距離為2的查詢結(jié)果

GET query_highlight/_search {"query": {"match": {"title": {"query": "door","fuzziness": "2"}}},"highlight": {"fields": {"title": {"pre_tags": ["<em>"],"post_tags": ["</em>"]},"body": {}}} }

3. multi_match查詢

PUT multi_match/_doc/1 {"title":"dog is friend","body":"we all should love and protect dogs,they are friend","detail":"do you really believe it is good thing" }PUT multi_match/_doc/2?refresh {"title":" cat is friend","body":"cat is my friend","detail":"do you really believe dog and cat is good thing" }

在title,body,detail中查找dog,而且三個(gè)字段的boost依次為1，2，3

GET multi_match/_search {"query": {"multi_match" : {"query": "dog","type": "most_fields","fields": [ "title", "body^2", "detail^3" ]}} }

4. 打分查詢

索引 movie-1，保存的電影信息，title是題目，tags是電影的標(biāo)簽。

在title中包含“my”或者“me”。

如果在tags中包含"romatic movies"，該條算分提高，如果不包含則算分

POST movie-1/_search {"query": {"bool": {"must": [{"terms": {"title": ["my","me"]}}],"should": {"match": {"tags": {"query": "romatic movies","boost": 2}}}}} }

5. alias設(shè)置查詢

為task23設(shè)定一個(gè)index alias名字為alias2，默認(rèn)查詢只返回評分大于3的電影。
要注意奧，alias是可以設(shè)置的時(shí)候同時(shí)指定過濾條件的。

POST /_aliases {"actions":[{"add":{"index":"task23","alias": "alias2","filter":{"range": {"score": {"gt": 3}}}}}] }

6. bool 查詢

寫一個(gè)查詢，要求某個(gè)關(guān)鍵字"new york"在task25這個(gè)索引中，4個(gè)字段(“overview”/“title”/“tags”/“tagline”)中至少包含兩個(gè)以上

POST task25/_search {"query": {"bool": {"should": [{"match": {"overview": "new york"}},{"match": {"title": "new york"}},{"match": {"tags": "new york"}},{"match": {"tagline": "new york"}}],"minimum_should_match": 2}} }

除了這樣寫好像真的沒有更好的辦法

7. 多個(gè)索引同一個(gè)alias,只有一個(gè)index可以寫入

POST _aliases {"actions": [{"add": {"index": "hamlet-1","alias": "hamlet","is_write_index": true}},{"add": {"index": "hamlet-2","alias": "hamlet"}}] }

8. scroll query

earth_quack 索引中有221條數(shù)據(jù)，按照每個(gè)batch 100條的方式進(jìn)行遍歷

GET earth_quack/_search?scroll=1m&size=100 {"query": {"range": {"Gap": {"gte": 10}}} }# 第二次的時(shí)候啥都不用帶了，直接繼續(xù)使用scroll_id查詢即可。 GET _search/scroll {"scroll": "1m","scroll_id": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAAkWSmxIWXRPbmFRSmloeWNTTUVXM0xtQQ==" }

4. 同義搜索

自定義分詞器盡量增加一個(gè)lowercase filter是一個(gè)好習(xí)慣的

1. 題目一 we-do 等同于wedo

要求

PUT synonym_test01/_doc/1 {"title":"we-do work","des":"we-do like do work",}PUT synonym_test01/_doc/2 {"title":"we-do work for a long time , you do not need do it ","des":"we-do like do work" }PUT synonym_test01/_doc/3 {"title":"wedo work it ","des":"wedo like do work we do " }GET synonym_test01/_search {"query": {"match": {"title": "wedo"}} }

只能查出來id為3的信息，要求使用x-x查詢和xx查詢的結(jié)果是一樣的也就是查詢 we-do和wedo結(jié)果一樣

PUT synonym_test {"settings": {"analysis": {"analyzer": {"synonym":{"type":"custom","tokenizer":"standard","char_filter":"map_filter"}},"char_filter": {"map_filter":{"type":"mapping","mappings":["- =>"]}}}},"mappings": {"properties": {"title":{"type": "text","analyzer": "synonym"}}} }POST _reindex {"source": {"index": "synonym_test01"},"dest": {"index": "synonym_test"} } GET synonym_test/_search {"query": {"match": {"title": "wedo"}} }

2. 題目二，dingding搜索

數(shù)據(jù)如下

PUT dingding_test/_bulk{"index":{"_id":1}}{"title":"oa is very good"}{"index":{"_id":2}}{"title":"oA is very good"}{"index":{"_id":3}}{"title":"OA is very good"}{"index":{"_id":4}}{"title":"dingding is very good"}{"index":{"_id":5}}{"title":"dingding is ali software"}{"index":{"_id":6}}{"title":"0A is very good"}

要求查詢 oa oA OA dingding 0A 這幾個(gè)出來的結(jié)果是一樣的，都能夠命中各個(gè)文檔。

DELETE dingding_test PUT dingding_test {"settings": {"analysis": {"analyzer": {"my_analyzer": {"type": "custom","tokenizer": "standard","filter": ["lowercase","synonym"]}},"filter": {"synonym": {"type": "synonym","synonyms": ["oa,0a,dingding"]}}}},"mappings": {"properties": {"title": {"type": "text","analyzer": "my_analyzer"}}} }GET dingding_test/_search{"query": {"match": {"title": "oA"}}}

3. 題目三 dog & cat搜索

有一個(gè)文檔，內(nèi)容類似dog & cat， 要求索引這條文檔，并且使用match_phrase query，查詢dog & cat或者dog and cat都能match

數(shù)據(jù)

PUT dog_and_cat/_bulk {"index":{ "_id":0}} {"title" : "dog and cat are my familly"} {"index":{ "_id":1}} {"title" : "do you love dog & cat"} {"index":{ "_id":2}} {"title" : "you will finally find dog cat"}

這一題要求的是用match_phrase查詢，而且隱含的一個(gè)知識點(diǎn)是&符號會被standard tokenizer去掉，注意不是在filter中去掉的，是在tokenizer中去掉的，所以必須在tokenizer之前對數(shù)據(jù)進(jìn)行處理，或者是換tokenizer處理。

PUT dog_and_cat02 {"settings": {"analysis": {"analyzer": {"my_analyzer":{"type":"custom","char_filter":["map_filter"],"tokenizer":"standard"}},"char_filter": {"map_filter":{"type":"mapping","mappings":["& => and"]}}}},"mappings": {"properties": {"title":{"type":"text","analyzer": "my_analyzer"}}} }

reindex and search

POST _reindex {"source": {"index": "dog_and_cat"},"dest": {"index": "dog_and_cat02"} }GET dog_and_cat02/_search {"query": {"match_phrase": {"title": "dog & cat"}} }

解法二使用同義詞，但是需要把tokenizer換成white space這樣的話才能保留&符號，進(jìn)而使用同義詞功能
參考 https://elasticsearch.cn/article/6133

5. multi_fields

1. 題目一： 多字段不同analyzer

PUT multi_fields/_doc/1 {"title":"manager","des":"this is the man who is more powerfull " } PUT multi_fields/_doc/2 {"title":"employee","des":"this is the man who really do the job " }

新建一個(gè)索引，為title設(shè)置多個(gè)字段，字段名為space_f使用whitespace analyzer,然后reindex當(dāng)前索引的數(shù)據(jù)到新的索引當(dāng)中

PUT multi_fields02 {"mappings": {"properties": {"des": {"type": "text","fields": {"space_f": {"type": "text","analyzer": "whitespace"}}},"title": {"type": "text","fields": {"space_f": {"type": "text","analyzer": "whitespace"}}}}} }POST _reindex {"source": {"index": "multi_fields"},"dest": {"index": "multi_fields02"} }

2. 題目二： 多字段不同analyzer

給出一個(gè)有數(shù)據(jù)的index multi_fields03，設(shè)計(jì)新的索引multi_fields04的mapings，然后把數(shù)據(jù)轉(zhuǎn)移到multi_fields04，其中xxx（字段名忘了）字段可以轉(zhuǎn)過去后用standard作為分詞器，并且新建兩個(gè)新字段一個(gè)字段名xxx.english,以english分詞，另一個(gè)字段名為xxx.stop,分詞器為stop,其他的field都取和原來的index類型一致。

數(shù)據(jù)樣例

PUT multi_fields03/_doc/1 {"content":"i want to be better","name":"chencc","age":180 }PUT multi_fields03/_doc/2 {"content":"she want a happy life","name":"zhaolu","age":18 }PUT multi_fields03/_doc/3 {"content":"best wish for you team","name":"wangj","age":28 }

創(chuàng)建mapping

PUT multi_fields04 {"mappings" : {"properties" : {"age" : {"type" : "long"},"content" : {"type" : "text","analyzer": "standard","fields" : {"english":{"type":"text","analyzer":"english"},"stop":{"type":"text","analyzer":"stop"}}},"name" : {"type" : "text","fields" : {"keyword" : {"type" : "keyword","ignore_above" : 256}}}}} }POST _reindex {"source": {"index": "multi_fields03"},"dest": {"index": "multi_fields04"} }

6. dynamic_template

以key_開頭的字段都是keyword類型
string 類型的以key_開頭的字段都是keyword類型

PUT _template/dynamic_template {"index_patterns": ["dynamic*"],"settings": {"number_of_shards": 3},"mappings": {"dynamic_templates": [{"key_word": {"match": "key_*","mapping": {"type": "keyword"}}}]} }PUT dynamic01/_doc/1 {"title":"this doc is for dynamic use","key_want":"go back","key_like":123 }GET dynamic01 對應(yīng)的兩個(gè)key開頭的字段都是keyword類型

假如增加一個(gè)對初始類型識別的限制則可以限制只把初始類型為string的并且以key_開頭的設(shè)置為keyword

PUT _template/dynamic_template02 {"index_patterns": ["02dyn*"],"settings": {"number_of_shards": 3},"mappings": {"dynamic_templates": [{"key_word": {"match_mapping_type":"string","match": "key_*","mapping": {"type": "keyword"}}}]} }GET 02dynamic/_doc/1 {"title":"this doc is for dynamic use","key_want":"go back","key_like":123 }GET 02dynamic ..."key_like" : {"type" : "long"},"key_want" : {"type" : "keyword"},...

7. date_range_and_count.txt

查詢國家為China,birth為2016年1-3月的women

PUT people_agg {"mappings": {"properties": {"birth": {"type": "date","format": "yyyy/MM/dd HH:mm:ss.SS"},"country": {"type": "keyword"},"sex": {"type": "keyword"},"des": {"type": "text"}}} }PUT people_agg/_doc/1 {"birth":"2016/01/04 21:18:48.64","country":"China","sex":"woman","des":"beauty woman" }PUT people_agg/_doc/2 {"birth":"2016/02/04 21:18:48.64","country":"China","sex":"woman","des":"beauty woman" }PUT people_agg/_doc/3 {"birth":"2016/01/04 21:18:48.64","country":"China","sex":"man","des":"beauty man" }PUT people_agg/_doc/4 {"birth":"2016/01/04 21:18:48.64","country":"Japan","sex":"woman","des":"beauty woman" }PUT people_agg/_doc/5 {"birth":"2016/03/04 21:18:48.64","country":"China","sex":"woman","des":"beauty woman" } GET people_agg/_count {"query": {"bool": {"must": [{"range": {"birth": {"gte": "01/2016","lte": "04/2016","format": "MM/yyyy||yyyy"}}},{"term": {"sex": {"value": "woman"}}},{"term": {"country": {"value": "China"}}}]}} }

需要注意的是這個(gè)地方的date格式的range查詢，時(shí)間應(yīng)該沒有辦法用等于來查詢
還有就是不用用agg查詢，直接使用count查詢就ok了。

8. aggregation search

1. 題目一：地震數(shù)據(jù)按月最大最小

地震數(shù)據(jù)，查找每個(gè)月最大深度和最遠(yuǎn)距離，同時(shí)賽選出來深度最大的月份

{"DateTime" : "2016/01/04 21:18:48.64","Latitude" : "37.3257","Longitude" : "-122.1043","Depth" : "-0.32","Magnitude" : "1.55","MagType" : "Md","NbStations" : "12","Gap" : "77","Distance" : "1","RMS" : "0.06","Source" : "NC","EventID" : "72573650"} GET earth_quack/_search?size=0 {"aggs": {"month": {"date_histogram": {"field": "DateTime","calendar_interval": "month"},"aggs": {"max_dep": {"max": {"field": "Depth"}},"max_dis":{"max": {"field": "Distance"}}}},"max_bucket":{"max_bucket": {"buckets_path": "month>max_dep"}}} }

這個(gè)是一個(gè)sibling 聚合，直接是最外層，parent聚合是在內(nèi)層

2. 題目二： 地震數(shù)據(jù)聚合結(jié)果過濾過濾

在1的基礎(chǔ)上過濾dep>0的數(shù)據(jù)

GET earth_quack/_search?size=0 {"aggs": {"month": {"date_histogram": {"field": "DateTime","calendar_interval": "month"},"aggs": {"max_dep": {"max": {"field": "Depth"}},"max_dis":{"max": {"field": "Distance"}},"dep_filter":{"bucket_selector": {"buckets_path": {"m_dep":"max_dep"},"script": "params.m_dep>0"}}}}} }

3. 題目三:bucket agg之間的嵌套

PUT log_agg { "mappings" : {"properties" : {"name" : {"type" : "text"},"param" : {"type" : "keyword"},"status" : {"type" : "long"},"uri" : {"type" : "keyword"}}} }

數(shù)據(jù)

PUT log_agg/_doc/1 {"uri":"/query","status":200,"param":"query dog" }PUT log_agg/_doc/2 {"uri":"/query","status":200,"param":"query cat" }PUT log_agg/_doc/3 {"uri":"/query","status":400,"param":"query bad" }PUT log_agg/_doc/4 {"uri":"/login","status":200,"param":"uid:123" }PUT log_agg/_doc/5 {"uri":"/login","status":400,"param":"uid:123 uid bad" }PUT log_agg/_doc/6 {"uri":"/login","status":400,"param":"uid:123,pass bad" }PUT log_agg/_doc/7 {"uri":"/login","status":302,"param":"uid:123,no user" }PUT log_agg/_doc/8 {"uri":"/register","status":302,"param":"phone:12345" }PUT log_agg/_doc/9 {"uri":"/register","status":302,"param":"query cat" }PUT log_agg/_doc/10 {"uri":"/register","status":400,"param":"server error" }

要求
查詢?nèi)罩疚募忻總€(gè)status請求排行前三的url。

這個(gè)剛開始沒有反應(yīng)過來可以這樣做，bucket之間是可以嵌套的，我以為只能bucket嵌套metric呢

GET log_agg/_search?size=0 {"aggs": {"status_term": {"terms": {"field": "status","size": 10},"aggs": {"uri_ter": {"terms": {"field": "uri","size": 3,"order": {"_count": "desc"}}}}}} }

返回

"aggregations" : {"status_term" : {"doc_count_error_upper_bound" : 0,"sum_other_doc_count" : 0,"buckets" : [{"key" : 400,"doc_count" : 4,"uri_ter" : {"doc_count_error_upper_bound" : 0,"sum_other_doc_count" : 0,"buckets" : [{"key" : "/login","doc_count" : 2},{"key" : "/query","doc_count" : 1},{"key" : "/register","doc_count" : 1}]}},{"key" : 200,"doc_count" : 3,"uri_ter" : {"doc_count_error_upper_bound" : 0,"sum_other_doc_count" : 0,"buckets" : [{"key" : "/query","doc_count" : 2},{"key" : "/login","doc_count" : 1}]}},{"key" : 302,"doc_count" : 3,"uri_ter" : {"doc_count_error_upper_bound" : 0,"sum_other_doc_count" : 0,"buckets" : [{"key" : "/register","doc_count" : 2},{"key" : "/login","doc_count" : 1}]}}]}}

4. 題目四：生產(chǎn)商排名

針對食品添加劑food ingredient這個(gè)索引為task15，要求添加劑字段

ingredient 這個(gè)name包含 tt，符合這個(gè)條件的top 10的供應(yīng)商 manufacturer。

POST task15/_search {"query": {"match": {"ingredient": "tt"}},"aggs": {"top_10": {"terms": {"field": "manufacturer"},"size": 10}} }

9. snapshot_and_restore

給集群創(chuàng)建一個(gè)數(shù)據(jù)倉庫，創(chuàng)建一個(gè)只包括work02_test09的快照信息
elasticsearch.yml文件配置

path.repo: ["/home/deploy/search/log-manager/single_node/repository_global"] PUT _snapshot/exam_bak {"type": "fs","settings": {"location": "exam_back01"} }POST _snapshot/exam_bak/_verifyPUT _snapshot/exam_bak/snapshot_1 {"indices": "work02_test09" }驗(yàn)證一下 GET _snapshot/exam_bak/snapshot_1

10. search_template

數(shù)據(jù)

PUT search_template/_doc/1 {"title":"i love pet ,and i want to have a dog","age":8 }PUT search_template/_doc/2 {"title":"i love pet ,and i want to have a cat","age":18 }PUT search_template/_doc/3 {"title":"i love pet","age":88 }

定義一個(gè)search_template,要求title字段中的內(nèi)容是params1，排序的字段是params2,排序方法是params3,取出來的size是size

GET _search/template {"id": "search_template","params": {"params1":“xxxx”，"params2":“xxxx”，"params2":“asc”，"size":10，} } 先大致的寫出queryGET search_template/_search {"query": {"match": {"title": "TEXT"}},"sort": [{"FIELD": {"order": "desc"}}],"size":10}填充到template當(dāng)中 PUT _scripts/template_query {"script": {"lang": "mustache","source": {"query": {"match": {"title": "{{params1}}"}},"sort": [{"{{params2}}": {"order": "{{params3}}"}}],"size":"{{size}}"}} }驗(yàn)證一下 GET _render/template/template_query {"params": {"params1":"pet","params2":"age","params3":"asc","size":10} }使用其進(jìn)行搜索GET search_template/_search/template {"id":"template_query","params": {"params1":"pet","params2":"age","params3":"desc","size":10} }

11. update_by_query

1. 題目一：內(nèi)容join

添加一個(gè)新字段，new_field,字段內(nèi)容是title、content按順序串聯(lián)起來，并且title的字段值只有text類型

PUT script_new_field/_doc/1 {"title":"save food","content":"we all should save food ,it is important" }PUT script_new_field/_doc/2 {"title":"protect water","content":"water is precious for all" }

解法一

POST script_new_field/_update_by_query {"script":{"lang":"painless","source":"ctx._source.new_field=ctx._source.title+' '+ctx._source.content"} } GET script_new_field/_search

解法二

PUT _ingest/pipeline/join_field {"description": "join two field","processors": [{"set": {"field": "new_ffff","value": "{{title}} {{content}}"}}] }POST script_new_field/_update_by_query?pipeline=join_field

2. 題目二：query過濾+script設(shè)置字段值

PUT city_update/_doc/1 {"city":"shanghai","name":"liurui" }PUT city_update/_doc/2 {"city":"wuhan","name":"liuao" }

將index中所有city為shanghai的數(shù)據(jù)修改為beijin

POST city_update/_update_by_query {"query":{"match":{"city":"shanghai"}},"script":{"lang":"painless","source":"ctx._source.city='beijin'"} }

12. reindex pipeline_use

POST _ingest/pipeline/_simulate {"pipeline" : {// pipeline definition here},"docs" : [{ "_source": {/** first document **/} },{ "_source": {/** second document **/} },// ...] }

只能是直接對pipeline進(jìn)行渲染，不能對已經(jīng)存儲的pipeline進(jìn)行渲染。
可以的

POST _ingest/pipeline/my-pipeline-id/_simulate {"docs" : [{ "_source": {/** first document **/} },{ "_source": {/** second document **/} },// ...] }

1. 題目一 字段分割，去除空格，統(tǒng)計(jì)長度

轉(zhuǎn)移一個(gè)index數(shù)據(jù)到另一個(gè)task2，其中原來index的數(shù)據(jù)為有個(gè)字段的數(shù)據(jù)為：" xx1 “,” xx2 “,” xx3 ",要求：
轉(zhuǎn)到tesk2的數(shù)據(jù)為以逗號分割的數(shù)組。
去掉每個(gè)分割出來的字符串的兩邊空格。
新增一個(gè)數(shù)組長度的字段num。

數(shù)據(jù)準(zhǔn)備

PUT pipe_origin/_doc/1 {"title":"teacher ,student , mom ","name":"diaom" }PUT pipe_origin/_doc/2 {"title":"father ,engneer,son","name":"chenq" }

處理

POST _ingest/pipeline/_simulate {"pipeline": {"description": "split int arr and count num","processors": [{"split": {"field": "title","target_field": "temp","separator": ","}},{"foreach": {"field": "temp","processor": {"trim": {"field": "_ingest._value"}}}},{"script": {"lang": "painless","source": "ctx.len=ctx.temp.length;"}}]},"docs": [{"_source": {"title": "teacher ,student , mom "}}] }POST _reindex {"source": {"index": "pipe_origin"},"dest": {"index": "pipe_dest","pipeline": "array_deal"} }

2. 題目二，字段拼接，字符串長度

數(shù)據(jù)準(zhǔn)備

PUT pipe_origin/_doc/1 {"title":"teacher ,student , mom ","name":"diaom" }PUT pipe_origin/_doc/2 {"title":"father ,engneer,son","name":"chenq" }

reindex 到新的dest index 當(dāng)中，增加一個(gè)新的字段join，值是這兩個(gè)字段的值拼接,并有另一個(gè)len統(tǒng)計(jì)join的字符數(shù)。

答案

POST _ingest/pipeline/_simulate {"pipeline": {"description": "split int arr and count num","processors": [{"set": {"field": "join","value": "{{name}} {{title}}"}},{"script": {"lang": "painless","source": "ctx.len=ctx.join.length()"}}]},"docs": [{"_source": {"title": "better man","name":"jack"}}] }PUT _ingest/pipeline/you_know {"description": "split int arr and count num","processors": [{"set": {"field": "join","value": "{{name}} {{title}}"}},{"script": {"lang": "painless","source": "ctx.len=ctx.join.length()"}}] }POST _reindex {"source": {"index": "pipe_origin"},"dest": {"index": "join_res","pipeline": "you_know"} }GET join_res/_search

13. allocation filter

1. 題目一： 冷熱架構(gòu)

部署三個(gè)節(jié)點(diǎn)的ES節(jié)點(diǎn),有一個(gè)屬性叫warm_hot
node01為hot，node02和node03是warm節(jié)點(diǎn)。
創(chuàng)建兩個(gè)索引task701,task702,兩個(gè)索引都是2個(gè)shard。一個(gè)shard都存在hot一個(gè)都存在warm當(dāng)中。

# node設(shè)置 node1: node.attr.warm_hot: hot node2: node.attr.warm_hot: warm node3: node.attr.warm_hot: warm索引設(shè)置 PUT task701 {"settings": {"index.routing.allocation.include.warm_hot":"warm","number_of_replicas": 0,"number_of_shards": 3} }PUT task702 {"settings": {"index.routing.allocation.include.warm_hot":"hot","number_of_replicas": 0,"number_of_shards": 3} }

2. 題目二：機(jī)架感知

三個(gè)節(jié)點(diǎn)有一個(gè)屬性rack
node01,node02為rack01, node03為rack02

創(chuàng)建一個(gè)索引task703,2個(gè)shard,1個(gè)replica,
讓task703的所有shard能夠?qū)崿F(xiàn)在rack01,rack02上的互備份。

node01: node.attr.rack: rack01 node02: node.attr.rack: rack01 node03: node.attr.rack: rack02PUT _cluster/settings {"persistent": {"cluster.routing.allocation.awareness.attributes": "rack","cluster.routing.allocation.awareness.force.rack.values": "rack01,rack02"} }PUT task703/ {"settings": { "number_of_replicas": 1,"number_of_shards": 2} }GET _cat/shards/task703

3. 題目三： 集群去除node, index去除node

index books1和books2都是3個(gè)主分片，1個(gè)副本分片。
要求books1只能分配在node-1上。
要求books2所有分片分配在node-2，node-3上。

不要上來就想著自定義attr,node name本身就是內(nèi)部自定義的，多好用

PUT books1 {"settings": {"index.routing.allocation.include.name":"node-1","number_of_shards": 3,"number_of_replicas": 0} } GET _cat/shards/books1PUT books2 {"settings": {"index.routing.allocation.include.name":"node-2,node-3","number_of_shards": 3,"number_of_replicas": 1} } GET _cat/shards/books2

要從集群中摘除node3,先把數(shù)據(jù)給自動遷移走

PUT _cluster/settings {"transient" : {"cluster.routing.allocation.exclude.name" : "node-1"} }

14. cross cluster search

在cluster1中寫入如下數(shù)據(jù)

PUT hamlet/_bulk {"index":{"_id":0}} {"line_number":"1","speaker":"BERNARDO","text_entry":"Whos there?"} {"index":{"_id":1}} {"line_number":"2","speaker":"FRANCISCO","text_entry":"Nay answer me: stand, and unfold yourself."}

在cluster2中寫入如下數(shù)據(jù)

PUT hamlet02/_bulk {"index":{"_id":0}} {"line_number":"1","speaker":"BERNARDO","text_entry":"Whos there?"} {"index":{"_id":1}} {"line_number":"2","speaker":"FRANCISCO","text_entry":"Nay answer me: stand, and unfold yourself."}

在cluster1中同時(shí)搜索兩個(gè)集群中speaker為FRANCISCO 的doc

PUT _cluster/settings {"persistent": {"cluster": {"remote": {"cluster_one": {"seeds": ["10.76.3.145:16300"],"transport.ping_schedule": "30s"}}}} }GET hamlet,cluster_one:hamlet02/_search {"query": {"match": {"speaker": "FRANCISCO"}} }

15. 截圖真題

https://github.com/mingyitianxia/elastic-certified-engineer/blob/master/review-practice/0011_zhenti.md

總結(jié)

以上是生活随笔為你收集整理的01. elasticsearch certification 练习题的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。