Elasticsearch的dsl语句学习

如来神掌十八式2026-04-21 13:28

Elasticsearch DSL 语法完整参考

一、索引操作

1.1 创建索引

json 复制代码 
PUT /my_index
{
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1,
    "refresh_interval": "1s",
    "max_result_window": 100000,
    "analysis": {
	  "analyzer": {
		"my_analyzer": {
		  "type": "custom",
		  "tokenizer": "ik_max_word",
		  "filter": ["lowercase", "my_stopwords"]
		},
		"ik_search_analyzer": {
		  "type": "custom",
		  "tokenizer": "ik_smart",
		  "filter": ["lowercase"]
		}
	  },
	  "filter": {
		"my_stopwords": {
		  "type": "stop",
		  "stopwords": ["_chinese_"]
		}
	  }
	},
    "index.mapping.total_fields.limit": 2000,
    "index.mapping.depth.limit": 20,
    "index.mapping.nested_fields.limit": 50,
    "index.mapping.nested_objects.limit": 10000
  },
  "mappings": {
    "properties": {
      "title": {
        "type": "text",
        "analyzer": "ik_max_word",
        "search_analyzer": "ik_smart",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          },
          "raw": {
            "type": "keyword"
          }
        }
      },
      "status": {
        "type": "keyword"
      },
      "price": {
        "type": "scaled_float",
        "scaling_factor": 100
      },
      "count": {
        "type": "integer"
      },
      "score": {
        "type": "float"
      },
      "created_at": {
        "type": "date",
        "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_millis"
      },
      "is_active": {
        "type": "boolean"
      },
      "location": {
        "type": "geo_point"
      },
      "shape": {
        "type": "geo_shape"
      },
      "ip_addr": {
        "type": "ip"
      },
      "content": {
        "type": "text",
        "term_vector": "with_positions_offsets"
      },
      "tags": {
        "type": "keyword"
      },
      "metadata": {
        "type": "object",
        "dynamic": "strict"
      },
      "comments": {
        "type": "nested",
        "properties": {
          "user": { "type": "keyword" },
          "message": { "type": "text" },
          "date": { "type": "date" }
        }
      },
      "suggest_field": {
        "type": "completion"
      },
      "binary_data": {
        "type": "binary"
      },
      "int_range": {
        "type": "integer_range"
      },
      "date_range": {
        "type": "date_range"
      },
      "join_field": {
        "type": "join",
        "relations": {
          "parent": "child"
        }
      },
      "rank_feature_field": {
        "type": "rank_feature"
      },
      "dense_vector_field": {
        "type": "dense_vector",
        "dims": 768,
        "index": true,
        "similarity": "cosine"
      },
      "flattened_field": {
        "type": "flattened"
      },
      "alias_field": {
        "type": "alias",
        "path": "title"
      }
    },
    "dynamic": "strict",
    "_source": {
      "enabled": true,
      "excludes": ["binary_data"]
    },
    "_routing": {
      "required": true
    }
  },
  "aliases": {
    "my_alias": {},
    "filtered_alias": {
      "filter": {
        "term": { "status": "active" }
      },
      "routing": "1"
    }
  }
}

1.2 字段类型详解

类型 说明
text 全文检索，会分词
keyword 精确匹配，不分词
long/integer/short/byte 整数类型
double/float/half_float/scaled_float 浮点类型
date 日期类型
boolean 布尔类型
binary Base64编码的二进制
object JSON对象
nested 嵌套对象（独立索引）
geo_point 经纬度坐标
geo_shape 复杂地理形状
ip IPv4/IPv6
completion 自动补全
token_count token数量
join 父子关系
rank_feature 排名特征
rank_features 多排名特征
dense_vector 密集向量
sparse_vector 稀疏向量
flattened 扁平化对象
shape 任意笛卡尔几何
histogram 直方图
alias 字段别名
search_as_you_type 即时搜索
unsigned_long 无符号长整型
version 版本号
wildcard 通配符关键字

1.3 修改索引 Mapping（新增字段）

json 复制代码 
PUT /my_index/_mapping
{
  "properties": {
    "new_field": {
      "type": "keyword"
    },
    "new_text_field": {
      "type": "text",
      "analyzer": "standard"
    },
    "new_nested": {
      "type": "nested",
      "properties": {
        "name": { "type": "text" },
        "value": { "type": "integer" }
      }
    }
  }
}

注意：ES 不支持直接修改已有字段类型，需要通过 reindex 实现。

1.4 索引设置修改

json 复制代码 
// 动态修改设置（需先关闭索引修改静态设置）
PUT /my_index/_settings
{
  "index": {
    "number_of_replicas": 2,
    "refresh_interval": "30s",
    "max_result_window": 50000
  }
}

// 关闭索引（修改静态设置前）
POST /my_index/_close

// 修改静态设置
PUT /my_index/_settings
{
  "analysis": {
    "analyzer": {
      "my_new_analyzer": {
        "type": "custom",
        "tokenizer": "standard",
        "filter": ["lowercase"]
      }
    }
  }
}

// 重新打开索引
POST /my_index/_open

1.5 删除索引

json 复制代码 
DELETE /my_index
DELETE /my_index_1,my_index_2
DELETE /my_index_*

1.6 索引别名操作

索引别名的作用是：为索引提供一个逻辑名称，实现索引切换、过滤和聚合，让应用无需修改代码即可透明地操作不同的索引。

json 复制代码 
// 添加别名
POST /_aliases
{
  "actions": [
    { "add": { "index": "my_index_v1", "alias": "my_index" } },
    { "remove": { "index": "my_index_v0", "alias": "my_index" } }
  ]
}

// 带过滤器的别名
POST /_aliases
{
  "actions": [
    {
      "add": {
        "index": "my_index",
        "alias": "active_items",
        "filter": { "term": { "status": "active" } },
        "routing": "1",
        "is_write_index": true
      }
    }
  ]
}

// 查看别名
GET /_alias/my_alias
GET /my_index/_alias/*

1.7 Reindex（重建索引）

ES 不允许直接修改已有字段的类型，所以当需要变更 mapping 时，只能通过 Reindex 把数据迁移到新索引。

json 复制代码 
POST /_reindex
{
  "source": {
    "index": "old_index",
    "query": {
      "term": { "status": "active" }
    },
    "_source": ["title", "content"],
    "size": 5000
  },
  "dest": {
    "index": "new_index",
    "pipeline": "my_pipeline",
    "op_type": "create"
  },
  "script": {
    "source": "ctx._source.tag = 'migrated'"
  },
  "conflicts": "proceed"
}

// 远程 reindex
POST /_reindex
{
  "source": {
    "remote": {
      "host": "http://otherhost:9200",
      "username": "user",
      "password": "pass"
    },
    "index": "source_index"
  },
  "dest": {
    "index": "dest_index"
  }
}

1.8 索引模板

索引模板的作用是：为符合命名模式的索引自动应用预设的 settings、mappings 和 aliases，避免每次创建索引时重复配置。

json 复制代码 
// 组合模板（新版，ES 7.8+）
PUT /_index_template/my_template
{
  "index_patterns": ["log-*"],
  "priority": 100,
  "template": {
    "settings": {
      "number_of_shards": 2
    },
    "mappings": {
      "properties": {
        "timestamp": { "type": "date" }
      }
    },
    "aliases": {
      "my_logs": {}
    }
  },
  "composed_of": ["component_template_1", "component_template_2"]
}

// 组件模板
PUT /_component_template/component_template_1
{
  "template": {
    "mappings": {
      "properties": {
        "@timestamp": { "type": "date" }
      }
    }
  }
}

1.9 索引生命周期管理 (ILM)

索引生命周期管理（ILM）的作用是：根据索引的年龄或大小自动将其在不同阶段（热、温、冷、删除）之间迁移，并执行相应的优化操作（如 rollover、shrink、forcemerge、delete），实现数据的自动化管理。

json 复制代码 
PUT /_ilm/policy/my_policy
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_size": "50gb",
            "max_age": "30d",
            "max_docs": 100000000
          },
          "set_priority": { "priority": 100 }
        }
      },
      "warm": {
        "min_age": "7d",
        "actions": {
          "shrink": { "number_of_shards": 1 },
          "forcemerge": { "max_num_segments": 1 },
          "set_priority": { "priority": 50 }
        }
      },
      "cold": {
        "min_age": "30d",
        "actions": {
          "freeze": {},
          "set_priority": { "priority": 0 }
        }
      },
      "delete": {
        "min_age": "90d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

1.10 其他索引操作

json 复制代码 
// 刷新索引
POST /my_index/_refresh

// 强制合并段
POST /my_index/_forcemerge?max_num_segments=1

// 冻结/解冻索引
POST /my_index/_freeze
POST /my_index/_unfreeze

// 克隆索引
POST /my_index/_clone/my_index_clone

// 收缩索引
POST /my_index/_shrink/my_index_shrunk
{
  "settings": {
    "index.number_of_shards": 1,
    "index.number_of_replicas": 1
  }
}

// 拆分索引
POST /my_index/_split/my_index_split
{
  "settings": {
    "index.number_of_shards": 6
  }
}

// 查看索引信息
GET /my_index
GET /my_index/_mapping
GET /my_index/_settings
GET /my_index/_stats
GET /_cat/indices?v
GET /_cat/shards/my_index?v

// 判断索引是否存在
HEAD /my_index

二、文档操作（增删改查）

2.1 新增文档

json 复制代码 
// 指定ID
PUT /my_index/_doc/1
{
  "title": "Elasticsearch Guide",
  "status": "published",
  "created_at": "2024-01-01 12:00:00"
}

// 自动生成ID
POST /my_index/_doc
{
  "title": "Auto ID Document",
  "status": "draft"
}

// 仅创建（如存在则报错）
PUT /my_index/_create/1
{
  "title": "Only Create"
}

// 或使用 op_type
PUT /my_index/_doc/1?op_type=create
{
  "title": "Only Create"
}

2.2 批量操作 (Bulk API)

json 复制代码 
POST /_bulk
{"index": {"_index": "my_index", "_id": "1"}}
{"title": "Doc 1", "status": "active"}
{"index": {"_index": "my_index", "_id": "2"}}
{"title": "Doc 2", "status": "inactive"}
{"create": {"_index": "my_index", "_id": "3"}}
{"title": "Doc 3", "status": "active"}
{"update": {"_index": "my_index", "_id": "1"}}
{"doc": {"status": "updated"}}
{"delete": {"_index": "my_index", "_id": "2"}}

2.3 获取文档

json 复制代码 
// 根据ID获取
GET /my_index/_doc/1

// 仅获取 _source
GET /my_index/_source/1

// 指定返回字段
GET /my_index/_doc/1?_source_includes=title,status
GET /my_index/_doc/1?_source_excludes=content

// 批量获取
POST /my_index/_mget
{
  "ids": ["1", "2", "3"]
}

POST /_mget
{
  "docs": [
    { "_index": "my_index", "_id": "1", "_source": ["title"] },
    { "_index": "my_index", "_id": "2" }
  ]
}

// 检查文档是否存在
HEAD /my_index/_doc/1

2.4 更新文档

json 复制代码 
// 部分更新
POST /my_index/_update/1
{
  "doc": {
    "status": "updated",
    "updated_at": "2024-06-01"
  },
  "doc_as_upsert": true
}

// 脚本更新
POST /my_index/_update/1
{
  "script": {
    "source": "ctx._source.count += params.increment",
    "lang": "painless",
    "params": {
      "increment": 1
    }
  },
  "upsert": {
    "count": 1
  }
}

// 条件更新（query + script）
POST /my_index/_update_by_query
{
  "query": {
    "term": { "status": "draft" }
  },
  "script": {
    "source": "ctx._source.status = 'published'",
    "lang": "painless"
  },
  "conflicts": "proceed",
  "scroll_size": 1000
}

// 带 pipeline 的 update_by_query
POST /my_index/_update_by_query?pipeline=my_pipeline
{
  "query": {
    "match_all": {}
  }
}

2.5 删除文档

json 复制代码 
// 根据ID删除
DELETE /my_index/_doc/1

// 按条件删除
POST /my_index/_delete_by_query
{
  "query": {
    "range": {
      "created_at": {
        "lt": "2023-01-01"
      }
    }
  },
  "conflicts": "proceed",
  "scroll_size": 5000
}

// 带切片的并行删除
POST /my_index/_delete_by_query?slices=auto
{
  "query": {
    "match_all": {}
  }
}

2.6 乐观并发控制

json 复制代码 
// 使用 if_seq_no 和 if_primary_term
PUT /my_index/_doc/1?if_seq_no=10&if_primary_term=1
{
  "title": "Updated with optimistic concurrency"
}

// 使用 version（旧版外部版本）
PUT /my_index/_doc/1?version=5&version_type=external
{
  "title": "External version control"
}

三、查询 DSL

3.1 Match 系列查询

json 复制代码 
// match - 全文检索
POST /my_index/_search
{
  "query": {
    "match": {
      "title": {
        "query": "elasticsearch guide",
        "operator": "and",
        "minimum_should_match": "75%",
        "analyzer": "standard",
        "fuzziness": "AUTO",
        "prefix_length": 2,
        "max_expansions": 50,
        "zero_terms_query": "all",
        "lenient": true,
        "boost": 1.5
      }
    }
  }
}

// match_phrase - 短语匹配
POST /my_index/_search
{
  "query": {
    "match_phrase": {
      "title": {
        "query": "quick brown fox",
        "slop": 2,
        "analyzer": "standard"
      }
    }
  }
}

// match_phrase_prefix - 短语前缀匹配
POST /my_index/_search
{
  "query": {
    "match_phrase_prefix": {
      "title": {
        "query": "elastic sea",
        "max_expansions": 50
      }
    }
  }
}

// multi_match - 多字段匹配
POST /my_index/_search
{
  "query": {
    "multi_match": {
      "query": "elasticsearch",
      "fields": ["title^3", "content^2", "tags"],
      "type": "best_fields",
      "tie_breaker": 0.3,
      "minimum_should_match": "70%",
      "operator": "or",
      "fuzziness": "AUTO"
    }
  }
}
// multi_match type 选项：
// best_fields  - 取最高分字段（默认）
// most_fields  - 综合所有字段得分
// cross_fields - 跨字段分析
// phrase       - 对每个字段做 match_phrase
// phrase_prefix- 对每个字段做 match_phrase_prefix
// bool_prefix  - 对每个字段做 bool 前缀

// match_bool_prefix
POST /my_index/_search
{
  "query": {
    "match_bool_prefix": {
      "title": {
        "query": "quick brown f",
        "analyzer": "standard"
      }
    }
  }
}

3.2 Term 级别查询

json 复制代码 
// term - 精确匹配
POST /my_index/_search
{
  "query": {
    "term": {
      "status": {
        "value": "active",
        "boost": 1.0
      }
    }
  }
}

// terms - 多值精确匹配
POST /my_index/_search
{
  "query": {
    "terms": {
      "status": ["active", "pending"],
      "boost": 1.0
    }
  }
}

// terms_set - 需满足最低匹配数
POST /my_index/_search
{
  "query": {
    "terms_set": {
      "tags": {
        "terms": ["red", "blue", "green"],
        "minimum_should_match_field": "required_matches",
        "minimum_should_match_script": {
          "source": "Math.min(params.num_terms, doc['required_matches'].value)"
        }
      }
    }
  }
}

// range - 范围查询
POST /my_index/_search
{
  "query": {
    "range": {
      "price": {
        "gte": 10,
        "lte": 100,
        "boost": 2.0
      }
    }
  }
}

// range - 日期范围
POST /my_index/_search
{
  "query": {
    "range": {
      "created_at": {
        "gte": "now-7d/d",
        "lte": "now/d",
        "format": "yyyy-MM-dd",
        "time_zone": "+08:00"
      }
    }
  }
}

// exists - 字段存在
POST /my_index/_search
{
  "query": {
    "exists": {
      "field": "tags"
    }
  }
}

// prefix - 前缀查询
POST /my_index/_search
{
  "query": {
    "prefix": {
      "title.keyword": {
        "value": "Elastic",
        "rewrite": "top_terms_N"
      }
    }
  }
}

// wildcard - 通配符查询
POST /my_index/_search
{
  "query": {
    "wildcard": {
      "title.keyword": {
        "value": "Elastic*ch",
        "boost": 1.0,
        "rewrite": "constant_score"
      }
    }
  }
}

// regexp - 正则查询
POST /my_index/_search
{
  "query": {
    "regexp": {
      "title.keyword": {
        "value": "Elast.+",
        "flags": "ALL",
        "max_determinized_states": 10000,
        "rewrite": "constant_score"
      }
    }
  }
}

// fuzzy - 模糊查询
POST /my_index/_search
{
  "query": {
    "fuzzy": {
      "title": {
        "value": "elastcsearch",
        "fuzziness": "AUTO",
        "prefix_length": 2,
        "max_expansions": 50,
        "transpositions": true
      }
    }
  }
}

// ids - ID查询
POST /my_index/_search
{
  "query": {
    "ids": {
      "values": ["1", "2", "3"]
    }
  }
}

// type - 类型查询（ES 7.x 已弃用）
POST /my_index/_search
{
  "query": {
    "type": {
      "value": "_doc"
    }
  }
}

3.3 复合查询

json 复制代码 
// bool 查询
POST /my_index/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "title": "elasticsearch" } }
      ],
      "must_not": [
        { "term": { "status": "deleted" } }
      ],
      "should": [
        { "term": { "tags": "popular" } },
        { "range": { "price": { "lte": 50 } } }
      ],
      "filter": [
        { "term": { "status": "active" } },
        { "range": { "created_at": { "gte": "2024-01-01" } } }
      ],
      "minimum_should_match": 1,
      "boost": 1.0
    }
  }
}

// boosting 查询
POST /my_index/_search
{
  "query": {
    "boosting": {
      "positive": {
        "match": { "title": "elasticsearch" }
      },
      "negative": {
        "term": { "status": "deprecated" }
      },
      "negative_boost": 0.5
    }
  }
}

// constant_score 查询
POST /my_index/_search
{
  "query": {
    "constant_score": {
      "filter": {
        "term": { "status": "active" }
      },
      "boost": 1.2
    }
  }
}

// dis_max 查询
POST /my_index/_search
{
  "query": {
    "dis_max": {
      "queries": [
        { "match": { "title": "elasticsearch" } },
        { "match": { "content": "elasticsearch" } }
      ],
      "tie_breaker": 0.7
    }
  }
}

// function_score 查询
POST /my_index/_search
{
  "query": {
    "function_score": {
      "query": { "match_all": {} },
      "boost": 5,
      "functions": [
        {
          "filter": { "match": { "title": "popular" } },
          "weight": 2
        },
        {
          "random_score": {
            "seed": 12345,
            "field": "_seq_no"
          }
        },
        {
          "field_value_factor": {
            "field": "likes",
            "factor": 1.2,
            "modifier": "sqrt",
            "missing": 1
          }
        },
        {
          "exp": {
            "created_at": {
              "origin": "now",
              "scale": "10d",
              "offset": "5d",
              "decay": 0.5
            }
          }
        },
        {
          "gauss": {
            "location": {
              "origin": "40.71,-74.01",
              "scale": "5km",
              "offset": "2km",
              "decay": 0.5
            }
          }
        },
        {
          "linear": {
            "price": {
              "origin": 50,
              "scale": 20,
              "decay": 0.5
            }
          }
        },
        {
          "script_score": {
            "script": {
              "source": "_score * doc['likes'].value / 10"
            }
          }
        }
      ],
      "score_mode": "multiply",
      "boost_mode": "replace",
      "max_boost": 10,
      "min_score": 5
    }
  }
}
// score_mode: multiply, sum, avg, first, max, min
// boost_mode: multiply, replace, sum, avg, max, min
// modifier: none, log, log1p, log2p, ln, ln1p, ln2p, square, sqrt, reciprocal

// script_score 查询
POST /my_index/_search
{
  "query": {
    "script_score": {
      "query": { "match": { "title": "elasticsearch" } },
      "script": {
        "source": "_score * doc['popularity'].value",
        "params": {
          "factor": 2
        }
      },
      "min_score": 10
    }
  }
}

// pinned 查询（置顶指定文档）
POST /my_index/_search
{
  "query": {
    "pinned": {
      "ids": ["1", "2", "3"],
      "organic": {
        "match": { "title": "elasticsearch" }
      }
    }
  }
}

3.4 嵌套查询与父子查询

json 复制代码 
// nested 查询
POST /my_index/_search
{
  "query": {
    "nested": {
      "path": "comments",
      "query": {
        "bool": {
          "must": [
            { "match": { "comments.user": "john" } },
            { "range": { "comments.date": { "gte": "2024-01-01" } } }
          ]
        }
      },
      "score_mode": "avg",
      "inner_hits": {
        "name": "matched_comments",
        "size": 5,
        "from": 0,
        "sort": [{ "comments.date": "desc" }],
        "_source": ["comments.user", "comments.message"],
        "highlight": {
          "fields": {
            "comments.message": {}
          }
        }
      }
    }
  }
}
// score_mode: avg, max, min, sum, none

// has_child 查询
POST /my_index/_search
{
  "query": {
    "has_child": {
      "type": "child",
      "query": {
        "match": { "title": "test" }
      },
      "min_children": 1,
      "max_children": 10,
      "score_mode": "avg",
      "inner_hits": {}
    }
  }
}

// has_parent 查询
POST /my_index/_search
{
  "query": {
    "has_parent": {
      "parent_type": "parent",
      "query": {
        "match": { "title": "parent doc" }
      },
      "score": true,
      "inner_hits": {}
    }
  }
}

// parent_id 查询
POST /my_index/_search
{
  "query": {
    "parent_id": {
      "type": "child",
      "id": "1"
    }
  }
}

3.5 全文查询补充

json 复制代码 
// query_string（支持 Lucene 语法）
POST /my_index/_search
{
  "query": {
    "query_string": {
      "query": "(elasticsearch OR solr) AND status:active",
      "default_field": "content",
      "fields": ["title^3", "content"],
      "default_operator": "AND",
      "analyzer": "standard",
      "allow_leading_wildcard": false,
      "enable_position_increments": true,
      "fuzziness": "AUTO",
      "fuzzy_prefix_length": 2,
      "phrase_slop": 0,
      "boost": 1.0,
      "analyze_wildcard": true,
      "auto_generate_synonyms_phrase_query": true,
      "minimum_should_match": "75%",
      "lenient": true
    }
  }
}

// simple_query_string（简化版，不报错）
POST /my_index/_search
{
  "query": {
    "simple_query_string": {
      "query": "\"fried eggs\" +(eggplant | potato) -frittata",
      "fields": ["title^5", "content"],
      "default_operator": "and",
      "flags": "OR|AND|NOT|PREFIX|PHRASE|PRECEDENCE",
      "minimum_should_match": "75%",
      "analyze_wildcard": true
    }
  }
}

// intervals 查询（精确控制词序和间距）
POST /my_index/_search
{
  "query": {
    "intervals": {
      "content": {
        "all_of": {
          "ordered": true,
          "intervals": [
            { "match": { "query": "quick", "max_gaps": 0 } },
            { "any_of": {
                "intervals": [
                  { "match": { "query": "brown" } },
                  { "match": { "query": "red" } }
                ]
              }
            },
            { "match": { "query": "fox" } }
          ],
          "max_gaps": 5
        }
      }
    }
  }
}

3.6 特殊查询

json 复制代码 
// match_all / match_none
POST /my_index/_search
{
  "query": { "match_all": { "boost": 1.0 } }
}

POST /my_index/_search
{
  "query": { "match_none": {} }
}

// more_like_this 查询
POST /my_index/_search
{
  "query": {
    "more_like_this": {
      "fields": ["title", "content"],
      "like": [
        { "_index": "my_index", "_id": "1" },
        "this is some text to find similar documents"
      ],
      "min_term_freq": 1,
      "min_doc_freq": 2,
      "max_query_terms": 25,
      "minimum_should_match": "30%",
      "boost_terms": 0,
      "include": false,
      "stop_words": ["the", "a"]
    }
  }
}

// percolate 查询（反向匹配）
POST /my_index/_search
{
  "query": {
    "percolate": {
      "field": "query",
      "document": {
        "title": "Elasticsearch is great",
        "status": "active"
      }
    }
  }
}

// wrapper 查询（Base64编码的查询）
POST /my_index/_search
{
  "query": {
    "wrapper": {
      "query": "eyJ0ZXJtIjp7InN0YXR1cyI6ImFjdGl2ZSJ9fQ=="
    }
  }
}

// rank_feature 查询
POST /my_index/_search
{
  "query": {
    "rank_feature": {
      "field": "rank_feature_field",
      "saturation": {
        "pivot": 10
      }
    }
  }
}

// distance_feature 查询
POST /my_index/_search
{
  "query": {
    "distance_feature": {
      "field": "location",
      "pivot": "1km",
      "origin": [40.71, -74.01]
    }
  }
}

// geo_bounding_box
POST /my_index/_search
{
  "query": {
    "geo_bounding_box": {
      "location": {
        "top_left": { "lat": 40.73, "lon": -74.1 },
        "bottom_right": { "lat": 40.01, "lon": -71.12 }
      }
    }
  }
}

// geo_distance
POST /my_index/_search
{
  "query": {
    "geo_distance": {
      "distance": "12km",
      "location": { "lat": 40.71, "lon": -74.01 }
    }
  }
}

// geo_shape
POST /my_index/_search
{
  "query": {
    "geo_shape": {
      "shape": {
        "shape": {
          "type": "envelope",
          "coordinates": [[-74.1, 40.73], [-71.12, 40.01]]
        },
        "relation": "within"
      }
    }
  }
}
// relation: intersects, disjoint, within, contains

// knn 向量搜索（ES 8.x+）
POST /my_index/_search
{
  "knn": {
    "field": "dense_vector_field",
    "query_vector": [0.1, 0.2, 0.3],
    "k": 10,
    "num_candidates": 100,
    "filter": {
      "term": { "status": "active" }
    }
  }
}

四、搜索功能

4.1 分页

json 复制代码 
// from + size 分页（浅分页，不适合深翻页）
POST /my_index/_search
{
  "from": 0,
  "size": 10,
  "query": { "match_all": {} }
}

// scroll 分页（适合大数据量导出）
POST /my_index/_search?scroll=5m
{
  "size": 1000,
  "query": { "match_all": {} }
}

// 后续滚动
POST /_search/scroll
{
  "scroll": "5m",
  "scroll_id": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAA..."
}

// 清除 scroll
DELETE /_search/scroll
{
  "scroll_id": ["DXF1ZXJ5QW5kRmV0Y2gBAAAAAA..."]
}

// search_after 分页（推荐的深翻页方式）
POST /my_index/_search
{
  "size": 10,
  "query": { "match_all": {} },
  "sort": [
    { "created_at": "desc" },
    { "_id": "asc" }
  ],
  "search_after": ["2024-06-01T12:00:00.000Z", "abc123"]
}

// Point in Time (PIT) + search_after（最佳实践）
// 创建 PIT
POST /my_index/_pit?keep_alive=5m

// 使用 PIT 搜索
POST /_search
{
  "size": 100,
  "query": { "match_all": {} },
  "pit": {
    "id": "46ToAwMDaWR5BXV1...",
    "keep_alive": "5m"
  },
  "sort": [
    { "created_at": { "order": "desc", "format": "strict_date_optional_time_nanos" } },
    { "_shard_doc": "asc" }
  ],
  "search_after": [...]
}

4.2 排序

json 复制代码 
POST /my_index/_search
{
  "sort": [
    { "created_at": { "order": "desc", "format": "strict_date_optional_time" } },
    { "price": { "order": "asc", "missing": "_last", "mode": "avg" } },
    { "title.keyword": { "order": "asc", "unmapped_type": "keyword" } },
    {
      "_geo_distance": {
        "location": { "lat": 40.71, "lon": -74.01 },
        "order": "asc",
        "unit": "km",
        "mode": "min",
        "distance_type": "arc"
      }
    },
    {
      "_script": {
        "type": "number",
        "script": {
          "source": "doc['likes'].value * params.factor",
          "params": { "factor": 1.1 }
        },
        "order": "desc"
      }
    },
    "_score",
    {
      "comments.date": {
        "order": "desc",
        "nested": {
          "path": "comments",
          "filter": { "term": { "comments.user": "john" } }
        }
      }
    }
  ],
  "query": { "match_all": {} }
}
// mode: min, max, sum, avg, median

4.3 Source 过滤

json 复制代码 
POST /my_index/_search
{
  "_source": false,
  "query": { "match_all": {} }
}

POST /my_index/_search
{
  "_source": ["title", "status"],
  "query": { "match_all": {} }
}

POST /my_index/_search
{
  "_source": {
    "includes": ["title", "meta.*"],
    "excludes": ["content", "*.secret"]
  },
  "query": { "match_all": {} }
}

4.4 高亮

json 复制代码 
POST /my_index/_search
{
  "query": { "match": { "content": "elasticsearch" } },
  "highlight": {
    "pre_tags": ["<em>"],
    "post_tags": ["</em>"],
    "fields": {
      "content": {
        "fragment_size": 150,
        "number_of_fragments": 3,
        "fragmenter": "span",
        "type": "unified",
        "boundary_scanner": "sentence",
        "boundary_scanner_locale": "en-US",
        "no_match_size": 200,
        "matched_fields": ["content", "content.plain"],
        "highlight_query": {
          "match": { "content": "elasticsearch guide" }
        }
      },
      "title": {
        "number_of_fragments": 0
      }
    },
    "encoder": "html",
    "require_field_match": false,
    "max_analyzed_offset": 1000000
  }
}
// type: unified（默认）, plain, fvh（fast vector highlighter）

4.5 Suggest（自动补全/拼写纠错）

json 复制代码 
// Term Suggest（拼写纠正）
POST /my_index/_search
{
  "suggest": {
    "my_suggest": {
      "text": "elastcsearch",
      "term": {
        "field": "title",
        "suggest_mode": "popular",
        "size": 5,
        "sort": "frequency",
        "string_distance": "internal",
        "max_edits": 2,
        "prefix_length": 1,
        "min_word_length": 4,
        "min_doc_freq": 0,
        "max_term_freq": 0.01
      }
    }
  }
}

// Phrase Suggest（短语纠正）
POST /my_index/_search
{
  "suggest": {
    "my_suggest": {
      "text": "elastc search gudie",
      "phrase": {
        "field": "title",
        "gram_size": 3,
        "confidence": 1,
        "max_errors": 2,
        "real_word_error_likelihood": 0.95,
        "highlight": {
          "pre_tag": "<em>",
          "post_tag": "</em>"
        },
        "collate": {
          "query": {
            "source": { "match": { "title": "{{suggestion}}" } }
          },
          "prune": true
        }
      }
    }
  }
}

// Completion Suggest（自动补全）
POST /my_index/_search
{
  "suggest": {
    "my_suggest": {
      "prefix": "elast",
      "completion": {
        "field": "suggest_field",
        "size": 10,
        "skip_duplicates": true,
        "fuzzy": {
          "fuzziness": "AUTO",
          "transpositions": true,
          "min_length": 3,
          "prefix_length": 1
        },
        "contexts": {
          "category": [{ "context": "tech", "boost": 2 }]
        }
      }
    }
  }
}

// Context Suggest
POST /my_index/_search
{
  "suggest": {
    "my_suggest": {
      "prefix": "elas",
      "completion": {
        "field": "suggest_field",
        "contexts": {
          "place_type": [
            { "context": "city", "boost": 2 },
            { "context": "country" }
          ],
          "location": [
            {
              "context": { "lat": 40.71, "lon": -74.01 },
              "precision": 5,
              "boost": 2
            }
          ]
        }
      }
    }
  }
}

4.6 Rescore（重新评分）

json 复制代码 
POST /my_index/_search
{
  "query": {
    "match": { "title": "elasticsearch" }
  },
  "rescore": {
    "window_size": 100,
    "query": {
      "rescore_query": {
        "match_phrase": {
          "title": {
            "query": "elasticsearch guide",
            "slop": 2
          }
        }
      },
      "query_weight": 0.7,
      "rescore_query_weight": 1.2,
      "score_mode": "total"
    }
  }
}
// score_mode: total, multiply, avg, max, min

4.7 Collapse（字段折叠/去重）

json 复制代码 
POST /my_index/_search
{
  "query": { "match": { "content": "elasticsearch" } },
  "collapse": {
    "field": "user_id",
    "inner_hits": {
      "name": "latest_posts",
      "size": 3,
      "sort": [{ "created_at": "desc" }]
    },
    "max_concurrent_group_searches": 4
  },
  "sort": [{ "created_at": "desc" }]
}

4.8 Script Fields

json 复制代码 
POST /my_index/_search
{
  "query": { "match_all": {} },
  "script_fields": {
    "total_price": {
      "script": {
        "source": "doc['price'].value * doc['quantity'].value",
        "lang": "painless"
      }
    },
    "discount_price": {
      "script": {
        "source": "doc['price'].value * (1 - params.discount)",
        "params": { "discount": 0.1 }
      }
    }
  },
  "_source": ["title", "price"]
}

4.9 Runtime Fields（运行时字段）

json 复制代码 
POST /my_index/_search
{
  "runtime_mappings": {
    "day_of_week": {
      "type": "keyword",
      "script": {
        "source": "emit(doc['created_at'].value.dayOfWeekEnum.getDisplayName(TextStyle.FULL, Locale.ROOT))"
      }
    },
    "price_with_tax": {
      "type": "double",
      "script": {
        "source": "emit(doc['price'].value * 1.13)"
      }
    }
  },
  "query": {
    "term": { "day_of_week": "Monday" }
  },
  "aggs": {
    "by_day": {
      "terms": { "field": "day_of_week" }
    }
  }
}

4.10 多索引搜索 (Multi Search)

json 复制代码 
POST /_msearch
{"index": "my_index_1"}
{"query": {"match": {"title": "test"}}, "size": 10}
{"index": "my_index_2"}
{"query": {"term": {"status": "active"}}, "size": 5}

4.11 搜索模板

json 复制代码 
// 创建搜索模板
PUT /_scripts/my_search_template
{
  "script": {
    "lang": "mustache",
    "source": {
      "query": {
        "bool": {
          "must": {
            "match": { "{{field}}": "{{query}}" }
          },
          "filter": {
            "range": {
              "created_at": {
                "gte": "{{start_date}}",
                "lte": "{{end_date}}"
              }
            }
          }
        }
      },
      "from": "{{from}}{{^from}}0{{/from}}",
      "size": "{{size}}{{^size}}10{{/size}}"
    }
  }
}

// 使用搜索模板
POST /my_index/_search/template
{
  "id": "my_search_template",
  "params": {
    "field": "title",
    "query": "elasticsearch",
    "start_date": "2024-01-01",
    "end_date": "2024-12-31",
    "size": 20
  }
}

4.12 Explain（解释评分）

json 复制代码 
// 解释某个文档为何匹配
GET /my_index/_explain/1
{
  "query": {
    "match": { "title": "elasticsearch" }
  }
}

// 搜索时加 explain
POST /my_index/_search
{
  "explain": true,
  "query": {
    "match": { "title": "elasticsearch" }
  }
}

// profile（性能分析）
POST /my_index/_search
{
  "profile": true,
  "query": {
    "match": { "title": "elasticsearch" }
  }
}

五、聚合查询 (Aggregations)

5.1 Metric 聚合

json 复制代码 
POST /my_index/_search
{
  "size": 0,
  "aggs": {
    "avg_price": { "avg": { "field": "price", "missing": 0 } },
    "max_price": { "max": { "field": "price" } },
    "min_price": { "min": { "field": "price" } },
    "sum_price": { "sum": { "field": "price" } },
    "count_docs": { "value_count": { "field": "price" } },
    "stats_price": { "stats": { "field": "price" } },
    "extended_stats_price": { "extended_stats": { "field": "price", "sigma": 2 } },
    "cardinality_users": {
      "cardinality": {
        "field": "user_id",
        "precision_threshold": 3000
      }
    },
    "percentiles_price": {
      "percentiles": {
        "field": "price",
        "percents": [25, 50, 75, 90, 95, 99],
        "keyed": true,
        "tdigest": { "compression": 200 }
      }
    },
    "percentile_ranks_price": {
      "percentile_ranks": {
        "field": "price",
        "values": [10, 50, 100]
      }
    },
    "median_absolute_deviation_price": {
      "median_absolute_deviation": { "field": "price" }
    },
    "weighted_avg_price": {
      "weighted_avg": {
        "value": { "field": "price" },
        "weight": { "field": "quantity" }
      }
    },
    "top_hits_docs": {
      "top_hits": {
        "size": 3,
        "sort": [{ "created_at": "desc" }],
        "_source": ["title", "price"]
      }
    },
    "top_metrics_latest": {
      "top_metrics": {
        "metrics": [
          { "field": "price" },
          { "field": "title.keyword" }
        ],
        "sort": { "created_at": "desc" },
        "size": 3
      }
    },
    "geo_bounds_location": {
      "geo_bounds": { "field": "location" }
    },
    "geo_centroid_location": {
      "geo_centroid": { "field": "location" }
    },
    "scripted_metric_example": {
      "scripted_metric": {
        "init_script": "state.transactions = []",
        "map_script": "state.transactions.add(doc['price'].value * doc['quantity'].value)",
        "combine_script": "double total = 0; for (t in state.transactions) { total += t } return total",
        "reduce_script": "double total = 0; for (a in states) { total += a } return total"
      }
    },
    "string_stats_title": {
      "string_stats": { "field": "title.keyword" }
    },
    "matrix_stats_example": {
      "matrix_stats": {
        "fields": ["price", "quantity"]
      }
    },
    "rate_monthly": {
      "rate": {
        "field": "price",
        "unit": "month"
      }
    }
  }
}

5.2 Bucket 聚合

json 复制代码 
POST /my_index/_search
{
  "size": 0,
  "aggs": {
    // terms 聚合
    "by_status": {
      "terms": {
        "field": "status",
        "size": 20,
        "min_doc_count": 1,
        "shard_min_doc_count": 0,
        "show_term_doc_count_error": true,
        "order": [
          { "_count": "desc" },
          { "_key": "asc" }
        ],
        "include": "active|pending",
        "exclude": "deleted",
        "missing": "N/A",
        "collect_mode": "breadth_first"
      },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    },

    // multi_terms 聚合（多字段联合）
    "by_status_and_category": {
      "multi_terms": {
        "terms": [
          { "field": "status" },
          { "field": "category" }
        ],
        "size": 20
      }
    },

    // rare_terms（低频词聚合）
    "rare_tags": {
      "rare_terms": {
        "field": "tags",
        "max_doc_count": 5
      }
    },

    // significant_terms（显著词聚合）
    "significant_tags": {
      "significant_terms": {
        "field": "tags",
        "min_doc_count": 5,
        "background_filter": {
          "term": { "category": "tech" }
        },
        "mutual_information": {
          "include_negatives": true,
          "background_is_superset": true
        }
      }
    },

    // significant_text
    "significant_content": {
      "significant_text": {
        "field": "content",
        "min_doc_count": 3,
        "filter_duplicate_text": true
      }
    },

    // histogram 聚合
    "price_histogram": {
      "histogram": {
        "field": "price",
        "interval": 50,
        "min_doc_count": 0,
        "extended_bounds": { "min": 0, "max": 500 },
        "hard_bounds": { "min": 0, "max": 1000 },
        "offset": 10,
        "keyed": true,
        "order": { "_key": "asc" },
        "missing": 0
      }
    },

    // variable_width_histogram
    "variable_price_hist": {
      "variable_width_histogram": {
        "field": "price",
        "buckets": 10
      }
    },

    // date_histogram 聚合
    "by_month": {
      "date_histogram": {
        "field": "created_at",
        "calendar_interval": "month",
        "format": "yyyy-MM",
        "time_zone": "+08:00",
        "offset": "+6h",
        "min_doc_count": 0,
        "extended_bounds": {
          "min": "2024-01",
          "max": "2024-12"
        },
        "keyed": true,
        "order": { "_key": "asc" },
        "missing": "2024-01-01"
      },
      "aggs": {
        "total_sales": { "sum": { "field": "price" } }
      }
    },

    // fixed_interval
    "by_hour": {
      "date_histogram": {
        "field": "created_at",
        "fixed_interval": "1h"
      }
    },

    // auto_date_histogram（自动选择间隔）
    "auto_date": {
      "auto_date_histogram": {
        "field": "created_at",
        "buckets": 10,
        "format": "yyyy-MM-dd",
        "time_zone": "+08:00",
        "minimum_interval": "day"
      }
    },

    // range 聚合
    "price_ranges": {
      "range": {
        "field": "price",
        "keyed": true,
        "ranges": [
          { "key": "cheap", "to": 50 },
          { "key": "moderate", "from": 50, "to": 100 },
          { "key": "expensive", "from": 100 }
        ]
      }
    },

    // date_range 聚合
    "date_ranges": {
      "date_range": {
        "field": "created_at",
        "format": "yyyy-MM-dd",
        "time_zone": "+08:00",
        "ranges": [
          { "to": "now-1M/M" },
          { "from": "now-1M/M", "to": "now/M" },
          { "from": "now/M" }
        ]
      }
    },

    // ip_range 聚合
    "ip_ranges": {
      "ip_range": {
        "field": "ip_addr",
        "ranges": [
          { "to": "10.0.0.5" },
          { "from": "10.0.0.5", "to": "10.0.0.10" },
          { "from": "10.0.0.10" }
        ]
      }
    },

    // filter 聚合
    "active_docs": {
      "filter": { "term": { "status": "active" } },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    },

    // filters 聚合
    "status_buckets": {
      "filters": {
        "other_bucket_key": "other_statuses",
        "filters": {
          "active": { "term": { "status": "active" } },
          "pending": { "term": { "status": "pending" } }
        }
      }
    },

    // global 聚合（忽略查询范围）
    "all_docs": {
      "global": {},
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    },

    // missing 聚合
    "docs_without_price": {
      "missing": { "field": "price" }
    },

    // nested 聚合
    "nested_comments": {
      "nested": { "path": "comments" },
      "aggs": {
        "top_users": {
          "terms": { "field": "comments.user" }
        }
      }
    },

    // reverse_nested 聚合
    "nested_comments_reverse": {
      "nested": { "path": "comments" },
      "aggs": {
        "by_user": {
          "terms": { "field": "comments.user" },
          "aggs": {
            "back_to_parent": {
              "reverse_nested": {},
              "aggs": {
                "avg_doc_price": { "avg": { "field": "price" } }
              }
            }
          }
        }
      }
    },

    // children/parent 聚合
    "child_docs": {
      "children": { "type": "child" },
      "aggs": {
        "top_child_titles": {
          "terms": { "field": "title.keyword" }
        }
      }
    },

    // sampler 聚合（采样）
    "sample": {
      "sampler": { "shard_size": 200 },
      "aggs": {
        "keywords": {
          "significant_terms": { "field": "tags" }
        }
      }
    },

    // diversified_sampler（多样化采样）
    "diverse_sample": {
      "diversified_sampler": {
        "shard_size": 200,
        "field": "category"
      },
      "aggs": {
        "keywords": {
          "significant_terms": { "field": "tags" }
        }
      }
    },

    // composite 聚合（组合聚合，支持翻页）
    "composite_agg": {
      "composite": {
        "size": 100,
        "sources": [
          { "status": { "terms": { "field": "status" } } },
          { "date": { "date_histogram": { "field": "created_at", "calendar_interval": "day" } } },
          { "price_range": { "histogram": { "field": "price", "interval": 50 } } }
        ],
        "after": { "status": "active", "date": 1609459200000, "price_range": 100 }
      },
      "aggs": {
        "avg_price": { "avg": { "field": "price" } }
      }
    },

    // adjacency_matrix（邻接矩阵）
    "interactions": {
      "adjacency_matrix": {
        "filters": {
          "grpA": { "term": { "group": "A" } },
          "grpB": { "term": { "group": "B" } },
          "grpC": { "term": { "group": "C" } }
        }
      }
    },

    // geo_distance 聚合
    "rings_around_point": {
      "geo_distance": {
        "field": "location",
        "origin": { "lat": 40.71, "lon": -74.01 },
        "unit": "km",
        "ranges": [
          { "to": 1 },
          { "from": 1, "to": 5 },
          { "from": 5, "to": 10 },
          { "from": 10 }
        ]
      }
    },

    // geohash_grid 聚合
    "geo_grid": {
      "geohash_grid": {
        "field": "location",
        "precision": 5,
        "bounds": {
          "top_left": { "lat": 41.0, "lon": -74.5 },
          "bottom_right": { "lat": 40.0, "lon": -73.5 }
        },
        "size": 10000,
        "shard_size": 50000
      }
    },

    // geotile_grid 聚合
    "geo_tile": {
      "geotile_grid": {
        "field": "location",
        "precision": 8
      }
    },

    // geohex_grid（ES 8.1+）
    "geo_hex": {
      "geohex_grid": {
        "field": "location",
        "precision": 4
      }
    }
  }
}

5.3 Pipeline 聚合

json 复制代码 
POST /my_index/_search
{
  "size": 0,
  "aggs": {
    "sales_per_month": {
      "date_histogram": {
        "field": "created_at",
        "calendar_interval": "month"
      },
      "aggs": {
        "total_sales": { "sum": { "field": "price" } },
        "total_quantity": { "sum": { "field": "quantity" } }
      }
    },

    // avg_bucket（桶平均值）
    "avg_monthly_sales": {
      "avg_bucket": {
        "buckets_path": "sales_per_month>total_sales",
        "gap_policy": "skip",
        "format": "#,##0.00"
      }
    },

    // sum_bucket
    "sum_monthly_sales": {
      "sum_bucket": {
        "buckets_path": "sales_per_month>total_sales"
      }
    },

    // max_bucket / min_bucket
    "max_monthly_sales": {
      "max_bucket": { "buckets_path": "sales_per_month>total_sales" }
    },
    "min_monthly_sales": {
      "min_bucket": { "buckets_path": "sales_per_month>total_sales" }
    },

    // stats_bucket / extended_stats_bucket
    "stats_monthly_sales": {
      "stats_bucket": { "buckets_path": "sales_per_month>total_sales" }
    },
    "extended_stats_sales": {
      "extended_stats_bucket": {
        "buckets_path": "sales_per_month>total_sales",
        "sigma": 2
      }
    },

    // percentiles_bucket
    "percentile_monthly_sales": {
      "percentiles_bucket": {
        "buckets_path": "sales_per_month>total_sales",
        "percents": [25, 50, 75, 95]
      }
    },

    // derivative（导数/环比）
    "sales_with_derivative": {
      "date_histogram": {
        "field": "created_at",
        "calendar_interval": "month"
      },
      "aggs": {
        "total_sales": { "sum": { "field": "price" } },
        "sales_deriv": {
          "derivative": { "buckets_path": "total_sales" }
        },
        "sales_2nd_deriv": {
          "derivative": { "buckets_path": "sales_deriv" }
        }
      }
    },

    // cumulative_sum（累计求和）
    "sales_cumulative": {
      "date_histogram": {
        "field": "created_at",
        "calendar_interval": "month"
      },
      "aggs": {
        "total_sales": { "sum": { "field": "price" } },
        "cumulative_sales": {
          "cumulative_sum": { "buckets_path": "total_sales" }
        }
      }
    },

    // cumulative_cardinality（累计基数）
    "cumulative_users": {
      "date_histogram": {
        "field": "created_at",
        "calendar_interval": "month"
      },
      "aggs": {
        "unique_users": { "cardinality": { "field": "user_id" } },
        "total_new_users": {
          "cumulative_cardinality": { "buckets_path": "unique_users" }
        }
      }
    },

    // moving_avg（移动平均）
    "sales_moving_avg": {
      "date_histogram": {
        "field": "created_at",
        "calendar_interval": "month"
      },
      "aggs": {
        "total_sales": { "sum": { "field": "price" } },
        "moving_avg_sales": {
          "moving_fn": {
            "buckets_path": "total_sales",
            "window": 5,
            "script": "MovingFunctions.unweightedAvg(values)"
          }
        },
        "moving_sum_sales": {
          "moving_fn": {
            "buckets_path": "total_sales",
            "window": 3,
            "script": "MovingFunctions.sum(values)"
          }
        },
        "linear_moving_avg": {
          "moving_fn": {
            "buckets_path": "total_sales",
            "window": 5,
            "script": "MovingFunctions.linearWeightedAvg(values)"
          }
        },
        "ewma_moving_avg": {
          "moving_fn": {
            "buckets_path": "total_sales",
            "window": 5,
            "script": "MovingFunctions.ewma(values, 0.3)"
          }
        },
        "holt_linear": {
          "moving_fn": {
            "buckets_path": "total_sales",
            "window": 5,
            "script": "MovingFunctions.holt(values, 0.3, 0.1)"
          }
        }
      }
    },

    // bucket_script（桶脚本）
    "sales_with_ratio": {
      "date_histogram": {
        "field": "created_at",
        "calendar_interval": "month"
      },
      "aggs": {
        "total_sales": { "sum": { "field": "price" } },
        "total_quantity": { "sum": { "field": "quantity" } },
        "avg_price_per_unit": {
          "bucket_script": {
            "buckets_path": {
              "sales": "total_sales",
              "qty": "total_quantity"
            },
            "script": "params.sales / params.qty",
            "gap_policy": "skip"
          }
        }
      }
    },

    // bucket_selector（桶选择器/过滤）
    "sales_filtered": {
      "date_histogram": {
        "field": "created_at",
        "calendar_interval": "month"
      },
      "aggs": {
        "total_sales": { "sum": { "field": "price" } },
        "filter_high_sales": {
          "bucket_selector": {
            "buckets_path": { "sales": "total_sales" },
            "script": "params.sales > 1000"
          }
        }
      }
    },

    // bucket_sort（桶排序）
    "top_categories": {
      "terms": {
        "field": "category",
        "size": 100
      },
      "aggs": {
        "total_sales": { "sum": { "field": "price" } },
        "sort_by_sales": {
          "bucket_sort": {
            "sort": [{ "total_sales": { "order": "desc" } }],
            "size": 10,
            "from": 0
          }
        }
      }
    },

    // serial_diff（序列差分）
    "sales_serial_diff": {
      "date_histogram": {
        "field": "created_at",
        "calendar_interval": "month"
      },
      "aggs": {
        "total_sales": { "sum": { "field": "price" } },
        "diff_sales": {
          "serial_diff": {
            "buckets_path": "total_sales",
            "lag": 1
          }
        }
      }
    },

    // normalize（归一化）
    "normalized_sales": {
      "date_histogram": {
        "field": "created_at",
        "calendar_interval": "month"
      },
      "aggs": {
        "total_sales": { "sum": { "field": "price" } },
        "percent_of_total": {
          "normalize": {
            "buckets_path": "total_sales",
            "method": "percent_of_sum"
          }
        }
      }
    },
    // method: rescale_0_1, rescale_0_100, percent_of_sum, mean, z-score, softmax

    // inference（推理聚合 - ML）
    "inference_results": {
      "date_histogram": {
        "field": "created_at",
        "calendar_interval": "month"
      },
      "aggs": {
        "total_sales": { "sum": { "field": "price" } },
        "total_quantity": { "sum": { "field": "quantity" } },
        "forecast": {
          "inference": {
            "model_id": "my_regression_model",
            "buckets_path": {
              "sales": "total_sales",
              "qty": "total_quantity"
            }
          }
        }
      }
    }
  }
}

5.4 聚合全局选项

json 复制代码 
POST /my_index/_search
{
  "size": 0,
  "query": { "match": { "title": "elasticsearch" } },
  "aggs": {
    "my_agg": {
      "terms": { "field": "status" }
    }
  },
  // 后置过滤（仅影响hits，不影响聚合）
  "post_filter": {
    "term": { "color": "red" }
  }
}

六、评分相关

6.1 自定义评分

json 复制代码 
// 使用 function_score（见 3.3）

// 使用 script_score
POST /my_index/_search
{
  "query": {
    "script_score": {
      "query": { "match_all": {} },
      "script": {
        "source": """
          double score = _score;
          if (doc['status'].value == 'featured') {
            score *= 2;
          }
          score += Math.log(1 + doc['likes'].value);
          return score;
        """
      }
    }
  }
}

// 向量评分（余弦相似度）
POST /my_index/_search
{
  "query": {
    "script_score": {
      "query": { "match_all": {} },
      "script": {
        "source": "cosineSimilarity(params.query_vector, 'dense_vector_field') + 1.0",
        "params": {
          "query_vector": [0.1, 0.2, 0.3]
        }
      }
    }
  }
}

// 点积
POST /my_index/_search
{
  "query": {
    "script_score": {
      "query": { "match_all": {} },
      "script": {
        "source": """
          double value = dotProduct(params.query_vector, 'dense_vector_field');
          return sigmoid(1, Math.E, -value);
        """,
        "params": {
          "query_vector": [0.1, 0.2, 0.3]
        }
      }
    }
  }
}

6.2 Index Boost（索引权重）

json 复制代码 
POST /index_1,index_2/_search
{
  "indices_boost": [
    { "index_1": 1.5 },
    { "index_2": 1.0 }
  ],
  "query": {
    "match": { "title": "elasticsearch" }
  }
}

6.3 Negative Boost

json 复制代码 
POST /my_index/_search
{
  "query": {
    "boosting": {
      "positive": { "match": { "content": "elasticsearch" } },
      "negative": { "term": { "status": "old" } },
      "negative_boost": 0.2
    }
  }
}

七、其他常用API

7.1 Count API

json 复制代码 
POST /my_index/_count
{
  "query": {
    "term": { "status": "active" }
  }
}

7.2 Validate API

json 复制代码 
POST /my_index/_validate/query?explain=true
{
  "query": {
    "match": { "title": "elasticsearch" }
  }
}

7.3 Field Capabilities

json 复制代码 
GET /my_index/_field_caps?fields=title,status,price

7.4 Terms Enum API

json 复制代码 
POST /my_index/_terms_enum
{
  "field": "tags",
  "string": "ela",
  "size": 10,
  "index_filter": {
    "range": { "created_at": { "gte": "2024-01-01" } }
  }
}

7.5 异步搜索

json 复制代码 
// 提交异步搜索
POST /my_index/_async_search?wait_for_completion_timeout=5s
{
  "query": { "match": { "content": "elasticsearch" } },
  "aggs": { "by_status": { "terms": { "field": "status" } } }
}

// 获取结果
GET /_async_search/<id>

// 删除异步搜索
DELETE /_async_search/<id>

7.6 Ingest Pipeline

json 复制代码 
// 创建 pipeline
PUT /_ingest/pipeline/my_pipeline
{
  "description": "My processing pipeline",
  "processors": [
    {
      "set": {
        "field": "ingest_time",
        "value": "{{_ingest.timestamp}}"
      }
    },
    {
      "rename": {
        "field": "old_field",
        "target_field": "new_field",
        "ignore_missing": true
      }
    },
    {
      "remove": {
        "field": ["temp_field"],
        "ignore_missing": true
      }
    },
    {
      "lowercase": { "field": "status" }
    },
    {
      "uppercase": { "field": "code" }
    },
    {
      "trim": { "field": "title" }
    },
    {
      "split": {
        "field": "tags_string",
        "separator": ",",
        "target_field": "tags"
      }
    },
    {
      "join": {
        "field": "tags",
        "separator": ", "
      }
    },
    {
      "grok": {
        "field": "message",
        "patterns": ["%{IP:client} %{WORD:method} %{URIPATHPARAM:request}"]
      }
    },
    {
      "dissect": {
        "field": "message",
        "pattern": "%{client} %{method} %{request}"
      }
    },
    {
      "date": {
        "field": "timestamp_string",
        "target_field": "@timestamp",
        "formats": ["yyyy-MM-dd HH:mm:ss", "ISO8601"]
      }
    },
    {
      "convert": {
        "field": "price",
        "type": "float"
      }
    },
    {
      "gsub": {
        "field": "content",
        "pattern": "\\s+",
        "replacement": " "
      }
    },
    {
      "script": {
        "source": "ctx.full_name = ctx.first_name + ' ' + ctx.last_name"
      }
    },
    {
      "pipeline": {
        "name": "another_pipeline"
      }
    },
    {
      "dot_expander": { "field": "meta.info" }
    },
    {
      "json": {
        "field": "json_string",
        "target_field": "parsed_json"
      }
    },
    {
      "user_agent": {
        "field": "agent_string"
      }
    },
    {
      "geoip": {
        "field": "client_ip",
        "target_field": "geo"
      }
    },
    {
      "enrich": {
        "policy_name": "users-policy",
        "field": "user_email",
        "target_field": "user_info"
      }
    },
    {
      "foreach": {
        "field": "items",
        "processor": {
          "uppercase": { "field": "_ingest._value.name" }
        }
      }
    },
    {
      "fail": {
        "if": "ctx.price < 0",
        "message": "Price cannot be negative: {{price}}"
      }
    },
    {
      "drop": {
        "if": "ctx.status == 'test'"
      }
    }
  ],
  "on_failure": [
    {
      "set": {
        "field": "error.message",
        "value": "{{_ingest.on_failure_message}}"
      }
    }
  ]
}

// 使用 pipeline 索引文档
POST /my_index/_doc?pipeline=my_pipeline
{
  "title": "Test Document",
  "message": "192.168.1.1 GET /index.html"
}

7.7 集群和节点信息

json 复制代码 
// 集群健康
GET /_cluster/health
GET /_cluster/health/my_index?level=shards

// 集群状态
GET /_cluster/state

// 集群统计
GET /_cluster/stats

// 节点信息
GET /_nodes
GET /_nodes/stats
GET /_nodes/hot_threads

// 任务管理
GET /_tasks
GET /_tasks?actions=*reindex
POST /_tasks/<task_id>/_cancel

八、常用日期数学表达式

表达式 含义
now 当前时间
now-1d 一天前
now-1d/d 一天前，向下取整到天
now/M 当月第一天
now+1M/M 下月第一天
`2024-01-01
now-7d/d 7天前向下取整到天

九、常用参数总结

参数 说明
size 返回文档数（默认10）
from 偏移量（默认0）
_source 控制返回字段
timeout 搜索超时
terminate_after 每个分片最多收集文档数
track_total_hits 是否精确统计总命中数
request_cache 是否使用请求缓存
preference 分片偏好（_local, _primary, 自定义值）
routing 路由值
search_type query_then_fetch（默认）/ dfs_query_then_fetch
batched_reduce_size 协调节点一次处理的分片数
allow_partial_search_results 是否允许部分结果
min_score 最低分过滤
explain 解释评分
version 返回文档版本号
seq_no_primary_term 返回序列号和主项

以上涵盖了 Elasticsearch DSL 的绝大多数语法，包括索引管理、文档 CRUD、全文检索、精确查询、复合查询、嵌套查询、父子查询、聚合（指标/桶/管道）、评分控制、分页、高亮、建议器、Pipeline 等核心功能。实际使用中需根据 ES 版本做适当调整（主要差异在 ES 6.x / 7.x / 8.x 之间）。

相关推荐
南棱笑笑生3 小时前
20260420给万象奥科的开发板HD-RK3576-PI适配瑞芯微原厂的Buildroot时使用ll命令
java·大数据·elasticsearch·rockchip
HUGu RGIN5 小时前
探索Spring Cloud Config：构建高可用的配置中心
大数据·elasticsearch·搜索引擎
晓庆的故事簿5 小时前
【无标题】
elasticsearch·jenkins
生万千欢喜心5 小时前
linux 安装 Elasticsearch Kibana
linux·elasticsearch·jenkins
Java后端的Ai之路5 小时前
SSH配置与GitHub项目拉取操作指南
elasticsearch·ssh·github·公钥
南棱笑笑生10 小时前
20260420给万象奥科的开发板HD-RK3576-PI适配瑞芯微原厂的Buildroot时调通AP6256并实测网速109Mbits/sec
大数据·elasticsearch·搜索引擎·rockchip
Elastic 中国社区官方博客15 小时前
Elasticsearch：使用 Agent Builder 的 A2A 实现 - 开发者的圣诞颂歌
大数据·数据库·人工智能·elasticsearch·搜索引擎·ai·全文检索
历程里程碑16 小时前
2. Git版本回退全攻略：轻松掌握代码时光机
大数据·c++·git·elasticsearch·搜索引擎·github·全文检索
饭后一颗花生米20 小时前
Git冷命令拯救崩溃现场
大数据·elasticsearch·搜索引擎
热门推荐
012026年4月技术前沿：AI大模型爆发、智能体革命与量子安全新纪元02GitHub 镜像站点032026 年 AI 编程助手全面对比评测：Cursor vs Copilot vs Claude Code vs GitHub Copilot Free042026年4月AI大事件深度解读：大模型竞争进入“深水区“05Claude Code Windows 兼容性问题：指定版本 2.1.112 可解决06AI Weekly | 2026年4月第二周 · GitHub热门项目与AI发展趋势深度解析07UBUNTU Claude Code 报错 claude native binary not installed08近期有什么ai的新消息，新动态？ 2026.4月09从限购到畅通：GLM-5.1 Coding Plan接入攻略10从零部署 Hermes Agent：一只"会成长的 AI 马"保姆级安装教程