Elasticsearch 入门到实战学习指南

// 存储服务器指标数据
{
  "@timestamp": "2024-01-15T10:30:00Z",
  "host": "web-server-01",
  "cpu_usage": 75.5,
  "memory_usage": 82.3,
  "disk_io": 1024,
  "network_in": 10485760,
  "network_out": 5242880
}

-- 建表
CREATE TABLE products (
    id INT PRIMARY KEY,
    name VARCHAR(200),
    price DECIMAL(10,2),
    description TEXT
);

-- 插入数据
INSERT INTO products VALUES (1, 'iPhone 15', 7999.00, '苹果最新款手机');

// PUT /products/_doc/1
{
  "id": 1,
  "name": "iPhone 15",
  "price": 7999.00,
  "description": "苹果最新款手机"
}

PUT /products
{
  "settings": {
    "number_of_shards": 3,      // 主分片数量（不可更改）
    "number_of_replicas": 1     // 每个主分片的副本数（可动态调整）
  }
}

GET /products/_search
{
  "explain": true,
  "query": {
    "match": {
      "name": "苹果手机"
    }
  }
}

{
  "hits": {
    "hits": [
      {
        "_id": "1",
        "_score": 5.123,
        "_explanation": {
          "value": 5.123,
          "description": "sum of:",
          "details": [
            {
              "value": 2.456,
              "description": "weight(name:苹果 in 0) [BM25]",
              "details": [
                {
                  "description": "idf, computed as log(1 + (N - n + 0.5) / (n + 0.5))",
                  "value": 1.234
                },
                {
                  "description": "tf, computed as freq / (freq + k1 * (1 - b + b * dl / avgdl))",
                  "value": 1.988
                }
              ]
            },
            {
              "value": 2.667,
              "description": "weight(name:手机 in 0) [BM25]"
            }
          ]
        }
      }
    ]
  }
}

PUT /my_index
{
  "settings": {
    "index": {
      "similarity": {
        "my_bm25": {
          "type": "BM25",
          "k1": 1.5,    // 调整词频饱和度
          "b": 0.5      // 调整文档长度影响
        }
      }
    }
  },
  "mappings": {
    "properties": {
      "title": {
        "type": "text",
        "similarity": "my_bm25"
      }
    }
  }
}

# 检查 Docker 版本
docker --version
# Docker version 24.0.7, build afdd53b

# 检查 Docker Compose 版本
docker-compose --version
# Docker Compose version v2.23.0

# 创建网络，便于 ES 和 Kibana 通信
docker network create elastic

# 启动 Elasticsearch 8.x（单节点模式）
docker run -d \
  --name elasticsearch \
  --net elastic \
  -p 9200:9200 \
  -p 9300:9300 \
  -e "discovery.type=single-node" \
  -e "xpack.security.enabled=false" \
  -e "ES_JAVA_OPTS=-Xms512m -Xmx512m" \
  elasticsearch:8.11.0

# 启动 Kibana
docker run -d \
  --name kibana \
  --net elastic \
  -p 5601:5601 \
  -e "ELASTICSEARCH_HOSTS=http://elasticsearch:9200" \
  kibana:8.11.0

version: '3.8'

services:
  elasticsearch:
    image: elasticsearch:8.11.0
    container_name: elasticsearch
    environment:
      # 单节点模式
      - discovery.type=single-node
      # 关闭安全认证（生产环境请开启）
      - xpack.security.enabled=false
      # JVM 堆内存设置（建议设置为可用内存的 50%，但不超过 32GB）
      - ES_JAVA_OPTS=-Xms1g -Xmx1g
      # 集群名称
      - cluster.name=es-docker-cluster
      # 节点名称
      - node.name=es-node-1
    ports:
      - "9200:9200"   # HTTP API 端口
      - "9300:9300"   # 节点间通信端口
    volumes:
      # 数据持久化
      - es-data:/usr/share/elasticsearch/data
      # 插件目录（如 IK 分词器）
      - es-plugins:/usr/share/elasticsearch/plugins
    networks:
      - elastic
    # 健康检查
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:9200/_cluster/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5

  kibana:
    image: kibana:8.11.0
    container_name: kibana
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - I18N_LOCALE=zh-CN   # 中文界面
    ports:
      - "5601:5601"
    networks:
      - elastic
    depends_on:
      elasticsearch:
        condition: service_healthy

volumes:
  es-data:
    driver: local
  es-plugins:
    driver: local

networks:
  elastic:
    driver: bridge

# 启动（后台运行）
docker-compose up -d

# 查看日志
docker-compose logs -f elasticsearch
docker-compose logs -f kibana

# 查看容器状态
docker-compose ps

# 停止服务
docker-compose stop

# 停止并删除容器（保留数据卷）
docker-compose down

# 停止并删除容器和数据卷（谨慎使用）
docker-compose down -v

# 方式一：进入容器安装
docker exec -it elasticsearch bash
./bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v8.11.0/elasticsearch-analysis-ik-8.11.0.zip
exit

# 重启 ES 使插件生效
docker restart elasticsearch

# 方式二：挂载本地插件目录（推荐）
# 1. 下载插件并解压到本地 plugins 目录
mkdir -p ./plugins/ik
cd ./plugins/ik
wget https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v8.11.0/elasticsearch-analysis-ik-8.11.0.zip
unzip elasticsearch-analysis-ik-8.11.0.zip

# 2. 修改 docker-compose.yml，添加挂载
volumes:
  - ./plugins:/usr/share/elasticsearch/plugins

# 查看已安装插件
curl http://localhost:9200/_cat/plugins?v

# 测试分词效果
curl -X POST "localhost:9200/_analyze?pretty" -H 'Content-Type: application/json' -d'
{
  "analyzer": "ik_max_word",
  "text": "中华人民共和国国歌"
}'

docker logs elasticsearch

# 检查 ES 是否正常运行
curl http://localhost:9200

# 检查网络连通性
docker exec kibana curl http://elasticsearch:9200

# 确认 Kibana 配置的 ES 地址正确
docker exec kibana cat /usr/share/kibana/config/kibana.yml

# CentOS
yum install -y java-11-openjdk java-11-openjdk-devel

# Ubuntu
apt-get install -y openjdk-11-jdk

# 验证
java -version

# 创建用户组和用户
groupadd elasticsearch
useradd -g elasticsearch -M -s /sbin/nologin elasticsearch

# 或者创建可登录的用户
useradd -g elasticsearch elasticsearch
passwd elasticsearch

# 1. 修改最大文件描述符数量
echo "* soft nofile 65536" >> /etc/security/limits.conf
echo "* hard nofile 65536" >> /etc/security/limits.conf

# 2. 修改最大虚拟内存区域数量（重要！）
echo "vm.max_map_count=262144" >> /etc/sysctl.conf
sysctl -p

# 3. 修改最大线程数
echo "* soft nproc 4096" >> /etc/security/limits.conf
echo "* hard nproc 4096" >> /etc/security/limits.conf

# 验证配置
ulimit -n   # 应该显示 65536
sysctl vm.max_map_count   # 应该显示 262144

# 创建安装目录
mkdir -p /opt/elasticsearch
cd /opt/elasticsearch

# 下载 ES（以 8.11.0 为例）
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.11.0-linux-x86_64.tar.gz

# 解压
tar -xzf elasticsearch-8.11.0-linux-x86_64.tar.gz
cd elasticsearch-8.11.0

# 修改目录所有者
chown -R elasticsearch:elasticsearch /opt/elasticsearch

# ======================== 集群配置 ========================
# 集群名称，同一集群内的节点必须一致
cluster.name: my-elasticsearch

# 节点名称，集群内唯一
node.name: node-1

# ======================== 路径配置 ========================
# 数据存储路径（建议使用 SSD）
path.data: /opt/elasticsearch/data

# 日志存储路径
path.logs: /opt/elasticsearch/logs

# ======================== 网络配置 ========================
# 绑定的 IP 地址，0.0.0.0 表示允许所有 IP 访问
network.host: 0.0.0.0

# HTTP API 端口
http.port: 9200

# 节点间通信端口
transport.port: 9300

# ======================== 集群发现配置 ========================
# 单节点模式（开发测试用）
discovery.type: single-node

# 多节点集群配置（生产环境）
# discovery.seed_hosts: ["192.168.1.101", "192.168.1.102", "192.168.1.103"]
# cluster.initial_master_nodes: ["node-1", "node-2", "node-3"]

# ======================== 安全配置 ========================
# 关闭安全认证（仅开发环境！生产环境必须开启）
xpack.security.enabled: false
xpack.security.enrollment.enabled: false
xpack.security.http.ssl.enabled: false
xpack.security.transport.ssl.enabled: false

# ======================== 内存配置 ========================
# 锁定内存，防止 swap（生产环境建议开启）
# bootstrap.memory_lock: true

# ======================== 跨域配置 ========================
# 允许跨域访问（开发环境方便调试）
http.cors.enabled: true
http.cors.allow-origin: "*"

# 堆内存设置（建议设置为物理内存的 50%，但不超过 32GB）
# 最小堆内存和最大堆内存设置相同，避免运行时调整
-Xms4g
-Xmx4g

# 如果内存较小，可以设置为
# -Xms1g
# -Xmx1g

# 切换到 elasticsearch 用户
su - elasticsearch

# 前台启动（可查看日志，Ctrl+C 退出）
cd /opt/elasticsearch/elasticsearch-8.11.0
./bin/elasticsearch

# 后台启动（daemon 模式）
./bin/elasticsearch -d -p pid

# 查看进程
ps -ef | grep elasticsearch
# 或
cat pid

# 停止服务
kill $(cat pid)
# 或
pkill -F pid

# 检查集群健康状态
curl http://localhost:9200/_cluster/health?pretty

# 查看节点信息
curl http://localhost:9200/_cat/nodes?v

# 查看集群信息
curl http://localhost:9200

{
  "name" : "node-1",
  "cluster_name" : "my-elasticsearch",
  "cluster_uuid" : "abc123...",
  "version" : {
    "number" : "8.11.0",
    "build_type" : "tar",
    "build_hash" : "...",
    "build_date" : "2023-11-04T10:04:57.184859352Z",
    "lucene_version" : "9.8.0",
    ...
  },
  "tagline" : "You Know, for Search"
}

# 创建服务文件
sudo vim /etc/systemd/system/elasticsearch.service

[Unit]
Description=Elasticsearch
Documentation=https://www.elastic.co
Wants=network-online.target
After=network-online.target

[Service]
Type=notify
RuntimeDirectory=elasticsearch
PrivateTmp=true
Environment=ES_HOME=/opt/elasticsearch/elasticsearch-8.11.0
Environment=ES_PATH_CONF=/opt/elasticsearch/elasticsearch-8.11.0/config
Environment=PID_DIR=/var/run/elasticsearch

User=elasticsearch
Group=elasticsearch

ExecStart=/opt/elasticsearch/elasticsearch-8.11.0/bin/elasticsearch -p ${PID_DIR}/elasticsearch.pid

# 资源限制
LimitNOFILE=65535
LimitNPROC=4096
LimitAS=infinity
LimitFSIZE=infinity

# 超时设置
TimeoutStopSec=0
KillMode=process
KillSignal=SIGTERM
SendSIGKILL=no
SuccessExitStatus=143

[Install]
WantedBy=multi-user.target

# 重载 systemd 配置
sudo systemctl daemon-reload

# 启动服务
sudo systemctl start elasticsearch

# 开机自启
sudo systemctl enable elasticsearch

# 查看状态
sudo systemctl status elasticsearch

# 查看日志
sudo journalctl -u elasticsearch -f

cd /opt/elasticsearch

# 下载 Kibana（版本需与 ES 一致）
wget https://artifacts.elastic.co/downloads/kibana/kibana-8.11.0-linux-x86_64.tar.gz

# 解压
tar -xzf kibana-8.11.0-linux-x86_64.tar.gz
cd kibana-8.11.0

# Kibana 服务端口
server.port: 5601

# 绑定的 IP 地址
server.host: "0.0.0.0"

# Kibana 服务名称
server.name: "my-kibana"

# Elasticsearch 地址
elasticsearch.hosts: ["http://localhost:9200"]

# 界面语言设置为中文
i18n.locale: "zh-CN"

# 如果 ES 开启了安全认证，需要配置用户名密码
# elasticsearch.username: "kibana_system"
# elasticsearch.password: "your_password"

# 启动 Kibana
./bin/kibana

# 后台启动
nohup ./bin/kibana > /dev/null 2>&1 &

# GET 请求
curl -X GET "localhost:9200/_cluster/health?pretty"

# POST 请求（带请求体）
curl -X POST "localhost:9200/my_index/_doc?pretty" \
  -H 'Content-Type: application/json' \
  -d '{"title": "Test", "content": "Hello World"}'

# PUT 请求
curl -X PUT "localhost:9200/my_index?pretty" \
  -H 'Content-Type: application/json' \
  -d '{"settings": {"number_of_shards": 1}}'

# DELETE 请求
curl -X DELETE "localhost:9200/my_index?pretty"

# Docker 启动
docker run -d --name cerebro \
  -p 9000:9000 \
  lmenezes/cerebro:0.9.4

# 访问 http://localhost:9000
# 输入 ES 地址：http://host.docker.internal:9200（Docker 环境）
# 或：http://你的IP:9200

docker run -d --name elastichq \
  -p 5000:5000 \
  elastichq/elasticsearch-hq

# 访问 http://localhost:5000

# 1. 检查 ES 状态
curl http://localhost:9200

# 2. 检查集群健康（应为 green 或 yellow）
curl http://localhost:9200/_cluster/health

# 3. 创建测试索引
curl -X PUT "localhost:9200/test_index?pretty"

# 4. 插入测试文档
curl -X POST "localhost:9200/test_index/_doc?pretty" \
  -H 'Content-Type: application/json' \
  -d '{"message": "Hello Elasticsearch!"}'

# 5. 搜索测试
curl "localhost:9200/test_index/_search?q=hello&pretty"

# 6. 删除测试索引
curl -X DELETE "localhost:9200/test_index?pretty"

PUT /my_index

PUT /products
{
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1,
    "refresh_interval": "1s",
    "max_result_window": 10000
  }
}

PUT /products
{
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1
  },
  "mappings": {
    "properties": {
      "id": {
        "type": "long"
      },
      "name": {
        "type": "text",
        "analyzer": "ik_max_word",
        "search_analyzer": "ik_smart"
      },
      "price": {
        "type": "double"
      },
      "category": {
        "type": "keyword"
      },
      "create_time": {
        "type": "date",
        "format": "yyyy-MM-dd HH:mm:ss||epoch_millis"
      }
    }
  }
}

GET /_cat/indices?v

// 查看索引的完整配置（settings + mappings + aliases）
GET /products

// 只查看 settings
GET /products/_settings

// 只查看 mappings
GET /products/_mapping

// 查看索引统计信息
GET /products/_stats

// 查看所有以 log 开头的索引
GET /log*/_settings

// 查看多个指定索引
GET /products,orders/_mapping

// 修改副本数量
PUT /products/_settings
{
  "number_of_replicas": 2
}

// 修改刷新间隔（批量写入时可设为 -1 禁用自动刷新以提升性能）
PUT /products/_settings
{
  "refresh_interval": "30s"
}

// 批量导入时的优化配置
PUT /products/_settings
{
  "refresh_interval": "-1",
  "number_of_replicas": 0
}

// 导入完成后恢复
PUT /products/_settings
{
  "refresh_interval": "1s",
  "number_of_replicas": 1
}

// 删除单个索引
DELETE /products

// 删除多个索引
DELETE /products,orders

// 使用通配符删除（危险操作！）
DELETE /log-2023-*

// 删除所有索引（极度危险！生产环境禁用）
DELETE /_all
DELETE /*

action.destructive_requires_name: true

// 关闭索引
POST /products/_close

// 打开索引
POST /products/_open

// 查看索引状态
GET /_cat/indices/products?v

// 直接写入文档，ES 自动创建索引和映射
POST /auto_index/_doc/1
{
  "name": "张三",
  "age": 25,
  "price": 99.9,
  "is_active": true,
  "create_time": "2024-01-15T10:30:00Z",
  "tags": ["技术", "编程"]
}

// 查看自动生成的映射
GET /auto_index/_mapping

{
  "auto_index": {
    "mappings": {
      "properties": {
        "name": { "type": "text", "fields": { "keyword": { "type": "keyword" } } },
        "age": { "type": "long" },
        "price": { "type": "float" },
        "is_active": { "type": "boolean" },
        "create_time": { "type": "date" },
        "tags": { "type": "text", "fields": { "keyword": { "type": "keyword" } } }
      }
    }
  }
}

PUT /products
{
  "mappings": {
    "properties": {
      "id": { "type": "long" },
      "name": {
        "type": "text",
        "analyzer": "ik_max_word"
      },
      "brand": { "type": "keyword" },
      "price": { "type": "scaled_float", "scaling_factor": 100 },
      "stock": { "type": "integer" },
      "on_sale": { "type": "boolean" },
      "create_time": { "type": "date" }
    }
  }
}

PUT /strict_index
{
  "mappings": {
    "dynamic": "strict",  // 遇到新字段直接报错
    "properties": {
      "name": { "type": "text" }
    }
  }
}

PUT /blog
{
  "mappings": {
    "properties": {
      "title": {
        "type": "text",           // 全文搜索
        "analyzer": "ik_max_word", // 索引时使用的分词器
        "search_analyzer": "ik_smart" // 搜索时使用的分词器
      },
      "status": {
        "type": "keyword"          // 精确匹配
      },
      "author": {
        "type": "text",
        "fields": {
          "keyword": {             // 多字段类型
            "type": "keyword",
            "ignore_above": 256
          }
        }
      }
    }
  }
}

{
  "price": {
    "type": "scaled_float",
    "scaling_factor": 100  // 存储时乘以 100，9.99 存储为 999
  }
}

{
  "create_time": {
    "type": "date",
    "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_millis"
  }
}

{
  "is_active": { "type": "boolean" }
}

PUT /users
{
  "mappings": {
    "properties": {
      "name": { "type": "text" },
      "address": {
        "type": "object",
        "properties": {
          "city": { "type": "keyword" },
          "street": { "type": "text" }
        }
      }
    }
  }
}

// 写入文档
POST /users/_doc/1
{
  "name": "张三",
  "address": {
    "city": "北京",
    "street": "朝阳区建国路"
  }
}

// 包含对象数组的文档
POST /orders/_doc/1
{
  "order_id": "1001",
  "items": [
    { "name": "iPhone", "quantity": 1 },
    { "name": "iPad", "quantity": 2 }
  ]
}

{
  "items.name": ["iPhone", "iPad"],
  "items.quantity": [1, 2]
}

PUT /orders
{
  "mappings": {
    "properties": {
      "order_id": { "type": "keyword" },
      "items": {
        "type": "nested",
        "properties": {
          "name": { "type": "keyword" },
          "quantity": { "type": "integer" }
        }
      }
    }
  }
}

PUT /shops
{
  "mappings": {
    "properties": {
      "name": { "type": "text" },
      "location": { "type": "geo_point" }
    }
  }
}

// 写入位置数据（多种格式都支持）
POST /shops/_doc/1
{
  "name": "星巴克朝阳店",
  "location": {
    "lat": 39.9042,
    "lon": 116.4074
  }
}

// 或使用数组格式 [经度, 纬度]
POST /shops/_doc/2
{
  "name": "星巴克海淀店",
  "location": [116.3074, 39.9842]
}

// 或使用字符串格式
POST /shops/_doc/3
{
  "name": "星巴克西城店",
  "location": "39.9142,116.3574"
}

PUT /articles
{
  "mappings": {
    "properties": {
      "title": {
        "type": "text",
        "analyzer": "ik_max_word",    // 索引分词器
        "search_analyzer": "ik_smart", // 搜索分词器
        "boost": 2.0,                  // 权重提升
        "index": true                  // 是否索引
      },
      "content": {
        "type": "text",
        "analyzer": "ik_max_word"
      },
      "author_id": {
        "type": "keyword",
        "doc_values": true,            // 用于排序和聚合
        "index": true
      },
      "internal_code": {
        "type": "keyword",
        "index": false,                // 不索引，仅存储
        "doc_values": false
      },
      "metadata": {
        "type": "object",
        "enabled": false               // 不索引不解析，原样存储
      },
      "tags": {
        "type": "keyword",
        "ignore_above": 100            // 超过 100 字符的值不索引
      }
    }
  }
}

PUT /articles
{
  "mappings": {
    "properties": {
      "title": {
        "type": "text",
        "copy_to": "full_text"
      },
      "content": {
        "type": "text",
        "copy_to": "full_text"
      },
      "full_text": {
        "type": "text"
      }
    }
  }
}

PUT /products/_mapping
{
  "properties": {
    "new_field": {
      "type": "keyword"
    }
  }
}

// 1. 创建新索引（使用新的 Mapping）
PUT /products_v2
{
  "mappings": {
    "properties": {
      "name": { "type": "text", "analyzer": "ik_smart" },  // 修改了分析器
      "price": { "type": "double" }  // 修改了类型
    }
  }
}

// 2. 使用 Reindex API 迁移数据
POST /_reindex
{
  "source": { "index": "products" },
  "dest": { "index": "products_v2" }
}

// 3. 确认数据迁移完成后，删除旧索引
DELETE /products

// 4. 使用别名指向新索引（推荐做法，见 4.4 节）
POST /_aliases
{
  "actions": [
    { "add": { "index": "products_v2", "alias": "products" } }
  ]
}

PUT /_template/logs_template
{
  "index_patterns": ["logs-*"],
  "order": 1,
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1,
    "refresh_interval": "5s"
  },
  "mappings": {
    "properties": {
      "@timestamp": { "type": "date" },
      "level": { "type": "keyword" },
      "message": { "type": "text" },
      "host": { "type": "keyword" },
      "service": { "type": "keyword" }
    }
  },
  "aliases": {
    "logs_current": {}
  }
}

// 1. 创建组件模板 - settings
PUT /_component_template/logs_settings
{
  "template": {
    "settings": {
      "number_of_shards": 3,
      "number_of_replicas": 1
    }
  }
}

// 2. 创建组件模板 - mappings
PUT /_component_template/logs_mappings
{
  "template": {
    "mappings": {
      "properties": {
        "@timestamp": { "type": "date" },
        "level": { "type": "keyword" },
        "message": { "type": "text" },
        "host": { "type": "keyword" }
      }
    }
  }
}

// 3. 创建索引模板，组合多个组件模板
PUT /_index_template/logs_template
{
  "index_patterns": ["logs-*"],
  "priority": 100,
  "composed_of": ["logs_settings", "logs_mappings"],
  "template": {
    "aliases": {
      "logs_current": {}
    }
  }
}

// 查看所有索引模板
GET /_index_template

// 查看特定模板
GET /_index_template/logs_template

// 查看组件模板
GET /_component_template/logs_settings

// 删除索引模板
DELETE /_index_template/logs_template

// 删除组件模板
DELETE /_component_template/logs_settings

// 测试模板效果（模拟创建索引）
POST /_index_template/_simulate_index/logs-2024-01-15

// 创建索引时指定别名
PUT /products_v1
{
  "aliases": {
    "products": {},
    "active_products": {
      "filter": {
        "term": { "status": "active" }
      }
    }
  }
}

// 为已存在的索引添加别名
POST /_aliases
{
  "actions": [
    { "add": { "index": "products_v1", "alias": "products" } }
  ]
}

// 查看所有别名
GET /_aliases

// 查看特定别名指向的索引
GET /_alias/products

// 查看特定索引的别名
GET /products_v1/_alias

POST /_aliases
{
  "actions": [
    { "remove": { "index": "products_v1", "alias": "products" } }
  ]
}

// 步骤 1：创建新索引
PUT /products_v2
{
  "mappings": { ... }
}

// 步骤 2：迁移数据
POST /_reindex
{
  "source": { "index": "products_v1" },
  "dest": { "index": "products_v2" }
}

// 步骤 3：原子切换别名（关键！）
POST /_aliases
{
  "actions": [
    { "remove": { "index": "products_v1", "alias": "products" } },
    { "add": { "index": "products_v2", "alias": "products" } }
  ]
}

// 步骤 4：验证无误后删除旧索引
DELETE /products_v1

// 创建指向多个索引的别名
POST /_aliases
{
  "actions": [
    { "add": { "index": "logs-2024-01", "alias": "logs_recent" } },
    { "add": { "index": "logs-2024-02", "alias": "logs_recent" } },
    { "add": { "index": "logs-2024-03", "alias": "logs_recent" } }
  ]
}

// 查询时只需指定别名
GET /logs_recent/_search
{
  "query": { "match_all": {} }
}

POST /_aliases
{
  "actions": [
    {
      "add": {
        "index": "products",
        "alias": "active_products",
        "filter": {
          "term": { "status": "active" }
        }
      }
    },
    {
      "add": {
        "index": "products",
        "alias": "expensive_products",
        "filter": {
          "range": { "price": { "gte": 1000 } }
        }
      }
    }
  ]
}

POST /_aliases
{
  "actions": [
    { "add": { "index": "logs-2024-02", "alias": "logs", "is_write_index": false } },
    { "add": { "index": "logs-2024-03", "alias": "logs", "is_write_index": true } }
  ]
}

// 通过别名写入时，数据会写入 logs-2024-03
POST /logs/_doc
{
  "@timestamp": "2024-03-15T10:30:00Z",
  "message": "This is a log message"
}

PUT /products/_doc/1
{
  "name": "iPhone 15 Pro",
  "brand": "Apple",
  "price": 9999.00,
  "category": "手机",
  "stock": 100,
  "on_sale": true,
  "tags": ["5G", "旗舰", "iOS"],
  "create_time": "2024-01-15T10:30:00Z"
}

{
  "_index": "products",
  "_id": "1",
  "_version": 1,
  "result": "created",       // created 表示新建，updated 表示更新
  "_shards": {
    "total": 2,
    "successful": 2,
    "failed": 0
  },
  "_seq_no": 0,
  "_primary_term": 1
}

PUT /products/_create/1
{
  "name": "iPhone 15 Pro",
  ...
}
// 如果文档 1 已存在，会返回 409 Conflict 错误

PUT /products/_doc/1?op_type=create
{
  "name": "iPhone 15 Pro",
  ...
}

POST /products/_doc
{
  "name": "小米14 Ultra",
  "brand": "Xiaomi",
  "price": 6499.00,
  "category": "手机"
}

{
  "_index": "products",
  "_id": "a1b2c3d4e5f6...",   // 自动生成的 ID（ULID 格式）
  "_version": 1,
  "result": "created",
  ...
}

POST /_bulk
{"index": {"_index": "products", "_id": "2"}}
{"name": "华为 Mate 60 Pro", "brand": "Huawei", "price": 6999.00, "category": "手机"}
{"index": {"_index": "products", "_id": "3"}}
{"name": "OPPO Find X7", "brand": "OPPO", "price": 4299.00, "category": "手机"}
{"create": {"_index": "products", "_id": "4"}}
{"name": "vivo X100 Pro", "brand": "vivo", "price": 4999.00, "category": "手机"}
{"update": {"_index": "products", "_id": "1"}}
{"doc": {"stock": 99}}
{"delete": {"_index": "products", "_id": "100"}}

{
  "took": 30,
  "errors": false,   // 是否有错误
  "items": [
    {
      "index": {
        "_index": "products",
        "_id": "2",
        "result": "created",
        "status": 201
      }
    },
    {
      "index": {
        "_index": "products",
        "_id": "3",
        "result": "created",
        "status": 201
      }
    },
    ...
  ]
}

// 导入前
PUT /products/_settings
{
  "refresh_interval": "-1",
  "number_of_replicas": 0
}

// 批量导入...

// 导入后恢复
PUT /products/_settings
{
  "refresh_interval": "1s",
  "number_of_replicas": 1
}

// 强制刷新使数据可搜索
POST /products/_refresh

GET /products/_doc/1

{
  "_index": "products",
  "_id": "1",
  "_version": 1,
  "_seq_no": 0,
  "_primary_term": 1,
  "found": true,           // 是否找到
  "_source": {             // 文档原始内容
    "name": "iPhone 15 Pro",
    "brand": "Apple",
    "price": 9999.00,
    ...
  }
}

{
  "_index": "products",
  "_id": "999",
  "found": false
}

HEAD /products/_doc/1
// 存在返回 200 OK
// 不存在返回 404 Not Found

// 方式一：在请求体中指定索引
GET /_mget
{
  "docs": [
    { "_index": "products", "_id": "1" },
    { "_index": "products", "_id": "2" },
    { "_index": "orders", "_id": "1001" }
  ]
}

// 方式二：在 URL 中指定索引（同一索引的多个文档）
GET /products/_mget
{
  "ids": ["1", "2", "3"]
}

{
  "docs": [
    {
      "_index": "products",
      "_id": "1",
      "found": true,
      "_source": { ... }
    },
    {
      "_index": "products",
      "_id": "2",
      "found": true,
      "_source": { ... }
    },
    {
      "_index": "products",
      "_id": "999",
      "found": false
    }
  ]
}

// 只返回指定字段
GET /products/_doc/1?_source=name,price

// 排除某些字段
GET /products/_doc/1?_source_excludes=tags,description

// 包含和排除组合
GET /products/_doc/1?_source_includes=name,price&_source_excludes=description

// 不返回 _source（只要元数据）
GET /products/_doc/1?_source=false

// 只返回 _source（不要元数据）
GET /products/_source/1

GET /products/_search
{
  "_source": ["name", "price", "brand"],
  "query": {
    "match_all": {}
  }
}

// 或使用对象形式
GET /products/_search
{
  "_source": {
    "includes": ["name", "price", "brand"],
    "excludes": ["description"]
  },
  "query": {
    "match_all": {}
  }
}

PUT /products/_doc/1
{
  "name": "iPhone 15 Pro Max",
  "brand": "Apple",
  "price": 10999.00,
  "category": "手机",
  "stock": 50
}

POST /products/_update/1
{
  "doc": {
    "price": 8999.00,
    "stock": 80
  }
}

{
  "_index": "products",
  "_id": "1",
  "_version": 2,
  "result": "updated",   // 如果内容没有变化，会返回 "noop"
  ...
}

POST /products/_update/1
{
  "doc": {
    "price": 8999.00
  },
  "detect_noop": false   // 即使值相同也执行更新（会增加版本号）
}

// 简单数值操作
POST /products/_update/1
{
  "script": {
    "source": "ctx._source.stock -= params.count",
    "params": {
      "count": 1
    }
  }
}

// 添加数组元素
POST /products/_update/1
{
  "script": {
    "source": "ctx._source.tags.add(params.tag)",
    "params": {
      "tag": "热销"
    }
  }
}

// 移除数组元素
POST /products/_update/1
{
  "script": {
    "source": "ctx._source.tags.remove(ctx._source.tags.indexOf(params.tag))",
    "params": {
      "tag": "热销"
    }
  }
}

// 条件更新
POST /products/_update/1
{
  "script": {
    "source": """
      if (ctx._source.stock > 0) {
        ctx._source.stock -= 1;
        ctx._source.sales += 1;
      } else {
        ctx.op = 'noop';  // 不执行操作
      }
    """
  }
}

// 根据条件删除文档
POST /products/_update/1
{
  "script": {
    "source": """
      if (ctx._source.stock <= 0) {
        ctx.op = 'delete';
      }
    """
  }
}