1、query string基础语法
GET /test_index/test_type/_search?q=test_field:test
GET /test_index/test_type/_search?q=+test_field:test
GET /test_index/test_type/_search?q=-test_field:test
default_field： test_field，查询的字段
query： test，需要查询的具体内容
一个是掌握q=default_field:query的语法，还有一个是掌握+和-的含义
+代表一定要出现：类似must。-代表一定不能包含：类似must_not
还有default_field不填默认是_all，即对所有字段进行查询。
1） test_field包含test关键词GET /test_index/test_type/_search?q=test_field:test
响应结果
{
"took": 3,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 3,
"max_score": 0.8835016,
"hits": [
{
"_index": "test_index",
"_type": "test_type",
"_id": "6",
"_score": 0.8835016,
"_source": {
"test_field": "test test"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "8",
"_score": 0.49191087,
"_source": {
"test_field": "test client 2"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "7",
"_score": 0.25316024,
"_source": {
"test_field": "test client 2"
}
}
]
}
}
GET /test_index/test_type/_search?q=+test_field:test
响应结果
{
"took": 7,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 3,
"max_score": 0.8835016,
"hits": [
{
"_index": "test_index",
"_type": "test_type",
"_id": "6",
"_score": 0.8835016,
"_source": {
"test_field": "test test"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "8",
"_score": 0.49191087,
"_source": {
"test_field": "test client 2"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "7",
"_score": 0.25316024,
"_source": {
"test_field": "test client 2"
}
}
]
}
}
与1）结果一样，都是精确查询，如果要模糊查询：
GET /test_index/test_type/_search?q=test_field:test~
响应结果
{
"took": 5,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 4,
"max_score": 0.8835016,
"hits": [
{
"_index": "test_index",
"_type": "test_type",
"_id": "6",
"_score": 0.8835016,
"_source": {
"test_field": "test test"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "8",
"_score": 0.49191087,
"_source": {
"test_field": "test client 2"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "2",
"_score": 0.46643263,
"_source": {
"test_field": "replaced test2"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "7",
"_score": 0.25316024,
"_source": {
"test_field": "test client 2"
}
}
]
}
}
GET /test_index/test_type/_search?q=-test_field:test
响应结果
{
"took": 7,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 1,
"hits": [
{
"_index": "test_index",
"_type": "test_type",
"_id": "10",
"_score": 1,
"_source": {
"test_field1": "test1",
"test_field2": "updated test2"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "12",
"_score": 1,
"_source": {
"test_field": "test12"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "4",
"_score": 1,
"_source": {
"test_field1": "test field111111"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "2",
"_score": 1,
"_source": {
"test_field": "replaced test2"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "1",
"_score": 1,
"_source": {
"test_field1": "test field1",
"test_field2": "bulk test1"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "11",
"_score": 1,
"_source": {
"num": 1,
"tags": []
}
}
]
}
}
当然query string这种方式是很少用到的，了解即可。
2、_all metadata的原理和作用搜索所有的field，任意一个field包含指定的关键字
GET /test_index/test_type/_search?q=test
响应结果
{
"took": 49,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 5,
"max_score": 0.7590336,
"hits": [
{
"_index": "test_index",
"_type": "test_type",
"_id": "8",
"_score": 0.7590336,
"_source": {
"test_field": "test client 2"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "6",
"_score": 0.59907764,
"_source": {
"test_field": "test test"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "4",
"_score": 0.42169982,
"_source": {
"test_field1": "test field111111"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "7",
"_score": 0.17225473,
"_source": {
"test_field": "test client 2"
}
},
{
"_index": "test_index",
"_type": "test_type",
"_id": "1",
"_score": 0.17225473,
"_source": {
"test_field1": "test field1",
"test_field2": "bulk test1"
}
}
]
}
}
直接可以搜索所有的field，任意一个field包含指定的关键字就可以搜索出来。我们在进行搜索的时候，难道是对document中的每一个field都进行一次搜索吗？不是的！
es中的_ all元数据，在建立索引的时候，我们插入一条document，它里面包含了多个field，此时，es会自动将多个field的值，全部用字符串的方式串联起来，变成一个长的字符串，作为_all field的值，同时建立倒排索引.
后面如果在搜索的时候，没有对某个field指定搜索，就默认搜索_all field，其中是包含了所有field的值的
举个例子
{
"name": "zhangsan",
"age": 18,
"email": "zhangsan@163.com",
"address": "beijing"
}
“zhangsan 18 zhangsan@163.com beijing”，作为这一条document的_all field的值，同时进行分词后建立对应的倒排索引
生产环境不使用
