官方链接：https://www.elastic.co/guide/en/elasticsearch/reference/7.17/index.html
1 索引的创建
1.1 创建一个简单的索引
1.创建一个简单的索引zhiyong18-zhiyong
- -X：指定http方法为PUT
- 默认是1分片，1副本
==提示：==也可以使用postman图形化软件实现操作
[root@elk91~]# curl -X PUT "http://10.0.0.91:9200/zhiyong18-zhiyong"
{"acknowledged":true,"shards_acknowledged":true,"index":"zhiyong18-zhiyong"}
[root@elk91~]# echo $?
0
1.2 创建索引时指定分片
1.创建索引时指定为3分片
PUT 10.0.0.92:9200/three-shard{"settings": {"number_of_shards": 3}
}
返回结果：200 OK
{"acknowledged": true,"shards_acknowledged": true,"index": "three-shard"
}
2.查看这条索引的信息
{"three-shard": {"aliases": {},"mappings": {},"settings": {"index": {"routing": {"allocation": {"include": {"_tier_preference": "data_content"}}},"number_of_shards": "3","provided_name": "three-shard","creation_date": "1731520141526","number_of_replicas": "1","uuid": "n8A_adczSMev00wj4vD9kw","version": {"created": "7172299"}}}}
}
1.3 创建索引时指定副本
指定为3分片和3副本
PUT 10.0.0.92:9200/three-replica{"settings": {"number_of_shards": 3,"number_of_replicas": 3}
}
2 索引的查看
提示：索引名称以 . 开头表示隐藏索引。
2.1 查看单条索引
查看上一步创建的索引
curl -X GET "10.0.0.91:9200/zhiyong18-zhiyong
输出为json格式，在linux命令行不明显，需要额外美化
{"zhiyong18-zhiyong": {"aliases": {},"mappings": {},"settings": {"index": {"routing": {"allocation": {"include": {"_tier_preference": "data_content"}}},"number_of_shards": "1","provided_name": "zhiyong18-zhiyong","creation_date": "1731516873526","number_of_replicas": "1","uuid": "dY-XygcfSNWqcsA6GiCYAw","version": {"created": "7172299"}}}}
}
-
索引名称：
zhiyong18-zhiyong -
别名（Aliases）：空（
"aliases": {}） -
映射（Mappings）：空（
"mappings": {}） -
设置（Settings）：
- index.routing.allocation.include._tier_preference:
data_content，该索引的路由会根据_tier_preference规则被分配到数据内容节点 - number_of_shards:
1索引设置了 1 个分片 - umber_of_replicas:
1 - provided_name:
zhiyong18-zhiyong - creation_date:
1731516873526，创建时间，时间戳 - uuid:
dY-XygcfSNWqcsA6GiCYAw，该索引的唯一标识符
- index.routing.allocation.include._tier_preference:
-
version: （版本）
- created:
7172299，7172299对应 Elasticsearch 7.17.22 版本
- created:
2.2 查看所有索引
[root@elk91~]# curl -X GET "http://10.0.0.91:9200/_cat/indices"
green open .geoip_databases iKrxOYj1SQ2ycYmmPA17OQ 1 1 35 0 67.2mb 33.6mb
green open zhiyong18-zhiyong dY-XygcfSNWqcsA6GiCYAw 1 1 0 0 454b 227b
2.3 查看索引表头信息
?v可以显示索引的标头信息
[root@elk91~]# curl -X GET "http://10.0.0.91:9200/_cat/indices?v"
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open .geoip_databases iKrxOYj1SQ2ycYmmPA17OQ 1 1 35 0 67.2mb 33.6mb
green open zhiyong18-zhiyong dY-XygcfSNWqcsA6GiCYAw 1 1 0 0 454b 227b
| health | status | index | uuid | pri | rep | docs.count | docs.deleted | store.size | pri.store.size |
|---|---|---|---|---|---|---|---|---|---|
| green | open | .geoip_databases | OeOOSf30ThmAX-IzPVLcLQ | 1 | 1 | 33 | 0 | 61.4mb | 30.7mb |
| green | open | zhiyong18-zhiyong | EQlFTFj5QqSMgbaJ8zGZ5Q | 1 | 1 | 0 | 0 | 452b | 226b |
多个分片
3个分片，每个分片一个副本，所以这个索引还是1个副本
3 索引的修改
3.1 修改索引的分片数量
1.把1分片改为2分片
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open .geoip_databases yn6pNHvZRSyVzRDaHUn3cg 1 1 37 0 70.6mb 35.3mb
green open three-replica-become-two ybf1MbgPQO-1ZyTOz1DPxg 1 2 0 0 681b 227b
2.把原有的1分片修改为2片
PUT 10.0.0.92:9200/three-replica-become-two/_settings
{"number_of_replicas": 2
}
3.查看验证
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open .geoip_databases yn6pNHvZRSyVzRDaHUn3cg 1 1 37 0 70.6mb 35.3mb
green open three-replica-become-two ybf1MbgPQO-1ZyTOz1DPxg 1 2 0 0 681b 227b
3.2 修改索引的副本数量
1.查看索引副本为3，现在改为2
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open .geoip_databases yn6pNHvZRSyVzRDaHUn3cg 1 1 37 0 70.6mb 35.3mb
yellow open three-replica-become-two ybf1MbgPQO-1ZyTOz1DPxg 1 3 0 0 681b 227b
PUT 10.0.0.92:9200/three-replica-become-two/_settings{"number_of_replicas": 2
}
2.再次查看索引状态为绿色。主分片和副本数量正好为3
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open .geoip_databases yn6pNHvZRSyVzRDaHUn3cg 1 1 37 0 70.6mb 35.3mb
green open three-replica-become-two ybf1MbgPQO-1ZyTOz1DPxg 1 2 0 0 681b 227b
4 索引的删除
==提示：==用通配符删除多条索引非常危险，可以禁用掉通配符，编辑elasticsearch.yml，设置 action.destructive_requires_name: true ，在执行破坏性的操作时就必须指定操作对象的名字。
1.查看索引three-replica-become-two
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open .geoip_databases yn6pNHvZRSyVzRDaHUn3cg 1 1 37 0 70.6mb 35.3mb
green open three-replica-become-two ybf1MbgPQO-1ZyTOz1DPxg 1 2 0 0 681b 227b
2.删除指定索引
DELETE 10.0.0.92:9200/three-replica-become-two
3.查看索引是否存在
GET 10.0.0.92:9200/three-replica-become-two
{"error": {"root_cause": [{"type": "index_not_found_exception","reason": "no such index [three-replica-become-two]","resource.type": "index_or_alias","resource.id": "three-replica-become-two","index_uuid": "_na_","index": "three-replica-become-two"}],"type": "index_not_found_exception","reason": "no such index [three-replica-become-two]","resource.type": "index_or_alias","resource.id": "three-replica-become-two","index_uuid": "_na_","index": "three-replica-become-two"},"status": 404
}
温馨提示：*可以匹配索引名称；这样意味着可以删除多个一zhiyong18开头的索引，非常危险。不过在elasticsearch.yml配置文件中提供了禁用删除统配符的配置。
# 批量删除
DELETE 10.0.0.91:9200/zhiyong18*
5 索引的开启和关闭
当不想写入数据时，但又想保留数据可以把索引给关闭，以停止数据的写入。
索引被关闭后就处于close状态，关闭后的索引不能检索数据
- 关闭：
POST 10.0.0.93:9200/index-name/_close
- 开启：
POST 10.0.0.93:9200/index-name/_open
当然也可以在kibana上关闭索引
