业务自己搭建了一套elasticsearch服务，最近几天查询开始变的越来越不稳定。

查看健康度发现status已经变成了red。

[root@localhost ~]# curl 'http://xxx.xxx.xxx.xxx:9200/_cluster/health?pretty'           
{
  "cluster_name" : "imageIndex",
  "status" : "red",
  "timed_out" : false,
  "number_of_nodes" : 4,
  "number_of_data_nodes" : 4,
  "active_primary_shards" : 4,
  "active_shards" : 6,
  "relocating_shards" : 1,
  "initializing_shards" : 0,
  "unassigned_shards" : 4,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 10
}
[root@localhost ~]#

问了下朋友，说是重启所有节点看看。

1. 停止所有节点服务

       curl -XPOST 'http://xxx.xxx.xxx.xxx:9200/_cluster/nodes/_shutdown'

2. 分别启动每一个节点

       ./bin/elasticsearch -d

3. 查看健康度

   [user_00@localhost ~]$ curl 'http://xxx.xxx.xxx.xxx:9200/_cluster/health?pretty'
   {
     "cluster_name" : "imageIndex",
     "status" : "yellow",
     "timed_out" : false,
     "number_of_nodes" : 4,
     "number_of_data_nodes" : 4,
     "active_primary_shards" : 5,
     "active_shards" : 5,
     "relocating_shards" : 0,
     "initializing_shards" : 5,
     "unassigned_shards" : 0,
     "delayed_unassigned_shards" : 0,
     "number_of_pending_tasks" : 0,
     "number_of_in_flight_fetch" : 0
   }

参考资料：
集群健康
elasticsearch如何安全重启节点(续)

elasticsearch每条记录都会有一个_version字段，在文档被改变时加一。

插入文档

curl 'http://你的elasticsearch地址/web/blog/1' -d '{"title": "test", "content": "test test test"}'

响应结果为

{
    "_index": "web", 
    "_type": "blog", 
    "_id": "1", 
    "_version": 1, 
    "created": true
}

检索文档

curl 'http://你的elasticsearch地址/web/blog/1'

响应结果为

{
  "_index" : "web",
  "_type" : "blog",
  "_id" : "1",
  "_version" : 1,
  "found" : true,
  "_source":{"title": "test", "content": "test test test"}
}

- 阅读剩余部分 -

排序代码如下:

{
    "sort": [
        {
            "porn_score": {
                "order": "desc"
            }
        }
    ]
}

直接报错Parse Failure [No mapping found for [filed] in order to sort on]]

修改后的代码如下:

{
    "sort": [
        {
            "porn_score": {
                "order": "desc", 
                "ignore_unmapped": true
            }
        }
    ]
}

最近用到elasticsearch，拼查询条件被虐了个半死...

多个字段的term查询

{
    "query": {
        "filtered": {
            "query": {
                "bool": {
                    "must": [
                        {
                            "term": {
                                "status": 0
                            }
                        }, 
                        {
                            "term": {
                                "file_id": "123456-abcde"
                            }
                        }
                    ]
                }
            }
        }
    }
}

- 阅读剩余部分 -