马士兵Elastic认证特训班

马士兵 Elastic 认证特训营：实战驱动 + 考点精讲，轻松拿下高含金量认证

从理论到实践，用代码解锁 Elasticsearch 核心技能

01 Elasticsearch 基础操作：索引与文档管理

创建索引并配置映射

// 创建商品索引
PUT /products
{
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1,
    "analysis": {
      "analyzer": {
        "pinyin_analyzer": {
          "tokenizer": "my_pinyin"
        }
      }
    }
  },
  "mappings": {
    "properties": {
      "product_name": {
        "type": "text",
        "analyzer": "ik_max_word",
        "fields": {
          "pinyin": {
            "type": "text",
            "analyzer": "pinyin_analyzer"
          }
        }
      },
      "price": {"type": "double"},
      "category": {"type": "keyword"},
      "tags": {"type": "keyword"},
      "create_time": {"type": "date"}
    }
  }
}

文档 CRUD 操作

// 添加商品文档
POST /products/_doc/1
{
  "product_name": "华为Mate60 Pro智能手机",
  "price": 6999.00,
  "category": "electronics",
  "tags": ["5G", "旗舰", "鸿蒙系统"],
  "create_time": "2024-01-15T10:30:00Z"
}

// 批量插入文档
POST /products/_bulk
{"index":{"_id":"2"}}
{"product_name":"苹果iPhone 15","price":5999.00,"category":"electronics","tags":["iOS","A17芯片"],"create_time":"2024-01-16T09:15:00Z"}
{"index":{"_id":"3"}}
{"product_name":"小米电视大师版","price":4999.00,"category":"appliances","tags":["4K","智能"],"create_time":"2024-01-17T14:20:00Z"}

// 更新文档
POST /products/_update/1
{
  "doc": {
    "price": 6499.00
  }
}

02 搜索查询实战：从基础到高级

基础搜索查询

// 匹配查询 - 搜索包含"华为"的商品
GET /products/_search
{
  "query": {
    "match": {
      "product_name": "华为"
    }
  }
}

// 多字段搜索 - 在商品名和标签中搜索
GET /products/_search
{
  "query": {
    "multi_match": {
      "query": "智能",
      "fields": ["product_name", "tags"]
    }
  }
}

// 范围查询 - 价格区间筛选
GET /products/_search
{
  "query": {
    "range": {
      "price": {
        "gte": 5000,
        "lte": 8000
      }
    }
  }
}

布尔组合查询

// 复杂条件组合查询
GET /products/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "product_name": "手机"
          }
        }
      ],
      "filter": [
        {
          "range": {
            "price": {
              "gte": 5000
            }
          }
        }
      ],
      "must_not": [
        {
          "term": {
            "category": "appliances"
          }
        }
      ]
    }
  },
  "sort": [
    {
      "price": {
        "order": "desc"
      }
    }
  ],
  "from": 0,
  "size": 10
}

03 聚合分析：数据洞察的核心技能

指标和桶聚合

// 多维度聚合分析
GET /products/_search
{
  "size": 0,
  "aggs": {
    "price_stats": {
      "stats": {
        "field": "price"
      }
    },
    "category_count": {
      "terms": {
        "field": "category",
        "size": 10
      },
      "aggs": {
        "avg_price": {
          "avg": {
            "field": "price"
          }
        }
      }
    },
    "price_histogram": {
      "histogram": {
        "field": "price",
        "interval": 1000
      }
    }
  }
}

嵌套聚合与管道聚合

// 复杂嵌套聚合
GET /products/_search
{
  "size": 0,
  "aggs": {
    "categories": {
      "terms": {
        "field": "category"
      },
      "aggs": {
        "price_percentiles": {
          "percentiles": {
            "field": "price",
            "percents": [25, 50, 75, 95]
          }
        },
        "significant_tags": {
          "significant_terms": {
            "field": "tags"
          }
        }
      }
    }
  }
}

04 索引管理：生命周期与模板

索引模板配置

// 创建索引模板
PUT _index_template/logs_template
{
  "index_patterns": ["logs-*"],
  "template": {
    "settings": {
      "number_of_shards": 2,
      "number_of_replicas": 1
    },
    "mappings": {
      "properties": {
        "timestamp": {"type": "date"},
        "level": {"type": "keyword"},
        "message": {"type": "text"},
        "service": {"type": "keyword"}
      }
    }
  },
  "priority": 200
}

索引生命周期管理 (ILM)

// 配置 ILM 策略
PUT _ilm/policy/logs_policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size": "50GB",
            "max_age": "30d"
          }
        }
      },
      "warm": {
        "min_age": "60d",
        "actions": {
          "shrink": {
            "number_of_shards": 1
          },
          "forcemerge": {
            "max_num_segments": 1
          }
        }
      },
      "cold": {
        "min_age": "90d",
        "actions": {
          "searchable_snapshot": {
            "snapshot_repository": "backup_repo"
          }
        }
      },
      "delete": {
        "min_age": "365d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

05 集群管理：运维与监控

集群健康与状态检查

// 检查集群健康状态
GET _cluster/health

// 获取节点信息
GET _cat/nodes?v

// 查看分片分配情况
GET _cat/allocation?v

// 索引状态详情
GET _cat/indices?v&s=index

分片管理操作

// 手动移动分片（用于平衡负载）
POST _cluster/reroute
{
  "commands": [
    {
      "move": {
        "index": "products",
        "shard": 0,
        "from_node": "node-1",
        "to_node": "node-2"
      }
    }
  ]
}

// 更新索引设置
PUT /products/_settings
{
  "index": {
    "number_of_replicas": 2,
    "refresh_interval": "30s"
  }
}

06 性能优化实战

搜索性能优化

// 使用过滤器上下文提升性能
GET /products/_search
{
  "query": {
    "bool": {
      "must": {
        "match": {
          "product_name": "旗舰"
        }
      },
      "filter": [
        {
          "term": {
            "category": "electronics"
          }
        },
        {
          "range": {
            "price": {
              "gte": 4000
            }
          }
        }
      ]
    }
  }
}

// 字段数据加载优化
PUT /products/_mapping
{
  "properties": {
    "tags": {
      "type": "keyword",
      "eager_global_ordinals": true
    }
  }
}

索引性能优化

// 批量索引设置优化
PUT /products/_settings
{
  "index": {
    "refresh_interval": "60s",
    "translog.durability": "async"
  }
}

// 使用 bulk API 进行高效批量操作
POST _bulk
{"index":{"_index":"products","_id":"100"}}
{"product_name":"优化测试商品","price":1000,"category":"test"}
{"index":{"_index":"products","_id":"101"}}
{"product_name":"另一个测试商品","price":2000,"category":"test"}

07 实战项目：电商搜索系统

完整搜索实现

// 电商商品搜索完整示例
GET /products/_search
{
  "query": {
    "function_score": {
      "query": {
        "bool": {
          "should": [
            {
              "multi_match": {
                "query": "华为手机",
                "fields": [
                  "product_name^3",
                  "tags^2",
                  "product_name.pinyin"
                ],
                "type": "best_fields"
              }
            }
          ],
          "filter": [
            {
              "term": {
                "category": "electronics"
              }
            },
            {
              "range": {
                "price": {
                  "gte": 3000,
                  "lte": 10000
                }
              }
            }
          ]
        }
      },
      "functions": [
        {
          "field_value_factor": {
            "field": "price",
            "factor": 0.1,
            "modifier": "reciprocal"
          }
        }
      ],
      "score_mode": "multiply"
    }
  },
  "aggs": {
    "category_filter": {
      "terms": {
        "field": "category"
      }
    },
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          {"to": 3000},
          {"from": 3000, "to": 6000},
          {"from": 6000}
        ]
      }
    }
  },
  "highlight": {
    "fields": {
      "product_name": {}
    }
  },
  "sort": [
    {"_score": {"order": "desc"}},
    {"price": {"order": "asc"}}
  ],
  "from": 0,
  "size": 20
}

08 故障排查与诊断

常见问题诊断命令

// 分析分片未分配原因
GET _cluster/allocation/explain
{
  "index": "products",
  "shard": 0,
  "primary": true
}

// 查看线程池状态
GET _cat/thread_pool?v

// 检查索引统计信息
GET /products/_stats

// 分析索引段信息
GET /products/_segments

// 慢查询日志分析
PUT /products/_settings
{
  "index": {
    "indexing.slowlog.threshold.index.warn": "10s",
    "indexing.slowlog.threshold.index.info": "5s",
    "search.slowlog.threshold.query.warn": "10s",
    "search.slowlog.threshold.query.info": "5s"
  }
}

---

掌握这些核心代码示例，你不仅能够顺利通过 Elastic 认证考试，更具备了在实际工作中构建高性能搜索系统、进行大数据分析处理的能力。马士兵 Elastic 认证特训营通过"代码驱动"的教学方式，让每个知识点都落地为可执行的解决方案，真正实现从理论到实践的完美跨越。