1掂碱、檢索拇砰、排序

terms表示查詢的內(nèi)容只要滿足任意一個(gè)都被搜索出來(lái)
sort節(jié)點(diǎn)指定排序字段
<pre>
{
"query": {
"terms": {
"content": [
"二季度",
"租房",
"上海"
]
}
},
"sort": {
"ttl": {
"order": "desc"
}
}
}
</pre>

2援雇、//should指的是滿足任意一個(gè)條件缨恒，must指的是滿足全部條件或must_no 排除 這個(gè)條件

<pre>
{
"query": {
"bool": {
"must": [
{ "match": { "content": "上海" } },
{ "match": { "url": "baidu" } },
{ "match": { "ch": 7 } }
]
}
}
}
</pre>

3蜂绎、全匹配 熬词，整個(gè)短語(yǔ)進(jìn)行匹配

<pre>
{
"query": {
"match_phrase": {
"content": "發(fā)生在上海"
}
}
}
</pre>

4旁钧、模糊查詢 ,query的內(nèi)容會(huì)自動(dòng)進(jìn)行分詞拆分

<pre>
{
"query": {
"query_string": {
"default_field": "content",
"query": "上海美國(guó)"
}
}
}
</pre>

5、鄰近,短語(yǔ)之間不超過(guò)多少個(gè)詞

<pre>
{"query": {
"match_phrase": {
"title": {
"query": "quick fox",
"slop": 15
}
}
}
}
</pre>
content包含“反正”和“避讓”互拾，間隔不超10詞
<pre>
{
"query": {
"match_phrase": {
"content": {
"query": "反正 避讓",
"slop": 10
}
}
}
}
</pre>

6歪今、having 聚合

context包含“今年”，按url聚合颜矿，聚合數(shù)>1,order by聚合數(shù)寄猩，時(shí)間范圍15/7/9-16/1/7
<pre>
{
"query" : {
"bool": {
"must":[
{"match": { "content" : "今年" }},
{
"query": {"range" : {
"ttl" : {
"gt" : "2015-07-09",
"lt" : "2016-01-07"
}
}}

   }
   ] 
}

},
"aggs": {
"url": {
"terms": {
"field": "url",
"size": 0,
"order" : { "_count" : "asc"}
},
"aggs": {
"having": {
"bucket_selector": {
"buckets_path": {
"url_count": "_count"
},
"script": {
"lang": "expression",
"inline": " url_count > 1"
}
}
}
}
}
},
"size": 0
}
</pre>
再增加一個(gè)having的示范，對(duì)于得sql語(yǔ)句為：
<pre>
SELECT ipo_year, COUNT(*) AS ipo_count FROM symbol
GROUP BY ipo_year HAVING ipo_count > 200
</pre>
DSL的語(yǔ)法為：
<pre>
{
"aggs": {
"ipo_year": {
"terms": {
"field": "ipo_year",
"size": 0
},
"aggs": {
"having": {
"bucket_selector": {
"buckets_path": {
"ipo_count": "_count"
},
"script": {
"lang": "expression",
"inline": " ipo_count > 200"
}
}
}
}
}
},
"size": 0
}
</pre>

7骑疆、content包含租房田篇，上海加權(quán)因子10，南京加權(quán)因子1

<pre>
{
"query": {
"bool": {
"must": {
"match": {
"content": {
"query": "租房",
"operator": "and"
}
}
},
"should": [
{ "match": { "content": {"query": "上海",
"boost": 10 }}},
{ "match": { "content": {"query": "南京",
"boost": 1} }}
]
}
}}
</pre>

8封断、組合filter

content:"上海","ch": 7,"url" :sina或者baidu
"size": 1表示為僅顯示1條結(jié)果斯辰，通過(guò)filter可以組成很復(fù)雜的查詢條件組合
<pre>
{
"query": {
"bool": {
"filter": [
{
"term": {
"content": "上海"
}
},
{
"term": {
"ch": 7
}
}
,
{
"terms": {
"url" : ["sina.com","baidu.com"]
}
}
]
}
},
"size": 1
}
</pre>

9、join查詢坡疼，需要安裝siren-join插件滿足

<pre>
{
"coordinate_search": {
"actions": [
{
"relations": {
"from": {
"indices": ["index2"],
"types": ["text2"],
"field": "ch"
},
"to": {
"indices": ["index"],
"types": ["text"],
"field": "foreign_key"
}
},
"size": 2,
"size_in_bytes": 20,
"is_pruned": false,
"cache_hit": false,
"terms_encoding" : "long",
"took": 313
}
]
}
}
</pre>
關(guān)于Elasticsearch如何支持join彬呻，這個(gè)slide總結(jié)得很好：http://www.slideshare.net/sirensolutions/searching-relational-data-with-elasticsearch。總體來(lái)說(shuō)有這么幾種方式：
? 完全不join闸氮，把關(guān)聯(lián)表的字段融合到一張表里剪况。當(dāng)然這會(huì)造成數(shù)據(jù)的冗余
? 錄入的時(shí)候join：使用 nested documents（nested document和主文檔是同segment存儲(chǔ)的，對(duì)于一個(gè)symbol蒲跨，幾千萬(wàn)個(gè)quote這樣的場(chǎng)景就不適合了）
? 錄入的時(shí)候join：使用 siren
? 查詢時(shí)join：使用 parent/child （這個(gè)是elasticsearch的特性译断，要求parent/child同shard存在）
? 查詢時(shí)join：使用 siren-joins（就是一個(gè)在服務(wù)端求值的filter，然后把結(jié)果發(fā)布給每個(gè)shard去做二次match）
? 查詢時(shí)join：在客戶端拼裝第二個(gè)查詢（和siren-joins差不多或悲，但是多了一次客戶端到服務(wù)器的來(lái)回）
? 查詢時(shí)join：在coordinate節(jié)點(diǎn)上做兩個(gè)查詢的join合并（https://github.com/NLPchina/elasticsearch-sql）
我個(gè)人喜歡的是siren-joins和客戶端拼裝這兩種方案孙咪。這兩種方案都是先做了一次查詢，把查詢結(jié)果再次分發(fā)到每個(gè)分布式節(jié)點(diǎn)上再次去做分布式的聚合巡语。相比在coordinate節(jié)點(diǎn)上去做join合并更scalable翎蹈。

Elasticsearch官方說(shuō)明如下（就算是不推薦，不要使用2個(gè)index就行join）：
Joining queriesedit

Performing full SQL-style joins in a distributed system like Elasticsearch is prohibitively expensive. Instead, Elasticsearch offers two forms of join which are designed to scale horizontally.

nested query Documents may contains fields of type nested. These fields are used to index arrays of objects, where each object can be queried (with the nested query) as an independent document. has_child and has_parent queries A parent-child relationship can exist between two document types within a single index. The has_child query returns parent documents whose child documents match the specified query, while the has_parent query returns child documents whose parent document matches the specified query.
Also see the terms-lookup mechanism in the terms query, which allows you to build a terms query from values contained in another document.