Skip to main content

Elasticsearch数据库管理

Elasticsearch是一个基于Lucene的分布式搜索和分析引擎，适用于全文搜索、日志分析、指标监控等场景。它具有实时搜索、分布式特性、RESTful API等优势。

Elasticsearch安装​

系统要求​

# 安装Java（Elasticsearch需要Java 8或更高版本）
sudo apt install openjdk-11-jdk  # Ubuntu/Debian
sudo yum install java-11-openjdk  # CentOS/RHEL

# 验证Java安装
java -version

使用包管理器安装​

Ubuntu/Debian系统​

# 下载并安装公钥
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

# 安装apt-transport-https
sudo apt install apt-transport-https

# 添加Elasticsearch仓库
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list

# 更新包列表并安装
sudo apt update
sudo apt install elasticsearch

CentOS/RHEL系统​

# 下载并安装公钥
sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

# 创建仓库文件
sudo tee /etc/yum.repos.d/elasticsearch.repo << EOF
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF

# 安装Elasticsearch
sudo yum install elasticsearch

手动安装​

# 下载Elasticsearch
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.17.0-linux-x86_64.tar.gz

# 解压
tar -xzf elasticsearch-7.17.0-linux-x86_64.tar.gz

# 移动到合适位置
sudo mv elasticsearch-7.17.0 /usr/local/elasticsearch

# 创建elasticsearch用户
sudo useradd -r -s /bin/false elasticsearch

# 设置权限
sudo chown -R elasticsearch:elasticsearch /usr/local/elasticsearch

Elasticsearch基本配置​

配置文件位置​

# 主配置文件
/etc/elasticsearch/elasticsearch.yml

# JVM配置
/etc/elasticsearch/jvm.options

# 日志配置
/etc/elasticsearch/log4j2.properties

核心配置参数​

# 集群名称
cluster.name: my-cluster

# 节点名称
node.name: node-1

# 网络配置
network.host: 0.0.0.0
http.port: 9200

# 集群发现
discovery.seed_hosts: ["host1", "host2"]
cluster.initial_master_nodes: ["node-1", "node-2"]

# 内存锁定
bootstrap.memory_lock: true

# 数据和日志路径
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch

# 内存配置
-Xms2g
-Xmx2g

JVM配置优化​

# /etc/elasticsearch/jvm.options
-Xms2g
-Xmx2g
-XX:+UseG1GC
-XX:G1ReservePercent=25
-XX:InitiatingHeapOccupancyPercent=30

Elasticsearch启动和管理​

系统服务管理​

# 启动Elasticsearch服务
sudo systemctl start elasticsearch

# 设置开机自启
sudo systemctl enable elasticsearch

# 检查服务状态
sudo systemctl status elasticsearch

# 停止服务
sudo systemctl stop elasticsearch

# 重启服务
sudo systemctl restart elasticsearch

手动启动​

# 切换到elasticsearch用户
sudo -u elasticsearch /usr/local/elasticsearch/bin/elasticsearch

# 后台运行
sudo -u elasticsearch /usr/local/elasticsearch/bin/elasticsearch -d

Elasticsearch基本操作​

REST API基础​

# 检查集群健康状态
curl -X GET "localhost:9200/_cluster/health?pretty"

# 查看节点信息
curl -X GET "localhost:9200/_nodes?pretty"

# 查看集群状态
curl -X GET "localhost:9200/_cluster/state?pretty"

# 查看统计信息
curl -X GET "localhost:9200/_stats?pretty"

索引操作​

# 创建索引
curl -X PUT "localhost:9200/my_index?pretty"

# 查看所有索引
curl -X GET "localhost:9200/_cat/indices?v"

# 删除索引
curl -X DELETE "localhost:9200/my_index?pretty"

# 查看索引设置
curl -X GET "localhost:9200/my_index/_settings?pretty"

# 更新索引设置
curl -X PUT "localhost:9200/my_index/_settings?pretty" -H 'Content-Type: application/json' -d'
{
  "index": {
    "number_of_replicas": 2
  }
}
'

文档操作​

# 创建文档
curl -X POST "localhost:9200/my_index/_doc/?pretty" -H 'Content-Type: application/json' -d'
{
  "title": "Elasticsearch入门",
  "author": "张三",
  "content": "这是一篇关于Elasticsearch的文章",
  "publish_date": "2023-01-01"
}
'

# 指定ID创建文档
curl -X PUT "localhost:9200/my_index/_doc/1?pretty" -H 'Content-Type: application/json' -d'
{
  "title": "Elasticsearch进阶",
  "author": "李四",
  "content": "这是一篇关于Elasticsearch进阶的文章",
  "publish_date": "2023-01-02"
}
'

# 获取文档
curl -X GET "localhost:9200/my_index/_doc/1?pretty"

# 更新文档
curl -X POST "localhost:9200/my_index/_update/1?pretty" -H 'Content-Type: application/json' -d'
{
  "doc": {
    "author": "王五"
  }
}
'

# 删除文档
curl -X DELETE "localhost:9200/my_index/_doc/1?pretty"

搜索操作​

# 简单搜索
curl -X GET "localhost:9200/my_index/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match_all": {}
  }
}
'

# 全文搜索
curl -X GET "localhost:9200/my_index/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match": {
      "content": "Elasticsearch"
    }
  }
}
'

# 多字段搜索
curl -X GET "localhost:9200/my_index/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "multi_match": {
      "query": "Elasticsearch 文章",
      "fields": ["title", "content"]
    }
  }
}
'

# 布尔查询
curl -X GET "localhost:9200/my_index/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "bool": {
      "must": [
        {"match": {"title": "Elasticsearch"}}
      ],
      "filter": [
        {"range": {"publish_date": {"gte": "2023-01-01"}}}
      ]
    }
  }
}
'

映射（Mapping）管理​

创建带映射的索引​

curl -X PUT "localhost:9200/blog?pretty" -H 'Content-Type: application/json' -d'
{
  "mappings": {
    "properties": {
      "title": {
        "type": "text",
        "analyzer": "ik_max_word"
      },
      "author": {
        "type": "keyword"
      },
      "content": {
        "type": "text",
        "analyzer": "ik_max_word"
      },
      "publish_date": {
        "type": "date",
        "format": "yyyy-MM-dd"
      },
      "tags": {
        "type": "keyword"
      }
    }
  }
}
'

查看映射​

# 查看索引映射
curl -X GET "localhost:9200/blog/_mapping?pretty"

# 查看特定字段映射
curl -X GET "localhost:9200/blog/_mapping/field/title?pretty"

更新映射​

# 添加新字段
curl -X PUT "localhost:9200/blog/_mapping?pretty" -H 'Content-Type: application/json' -d'
{
  "properties": {
    "category": {
      "type": "keyword"
    }
  }
}
'

Elasticsearch安全配置​

启用安全功能​

# elasticsearch.yml
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true

设置内置用户密码​

# 初始化密码
sudo /usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto

# 或交互式设置密码
sudo /usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive

配置SSL/TLS​

# 生成证书
sudo /usr/share/elasticsearch/bin/elasticsearch-certutil ca
sudo /usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12

使用认证的API调用​

# 使用认证
curl -u elastic:yourpassword -X GET "localhost:9200/_cluster/health?pretty"

# 使用API密钥
curl -H "Authorization: ApiKey your_api_key" -X GET "localhost:9200/_cluster/health?pretty"

Elasticsearch性能调优​

内存配置​

# jvm.options
-Xms4g
-Xmx4g
-XX:+UseG1GC
-XX:G1HeapRegionSize=4m
-XX:G1ReservePercent=15

索引性能优化​

# 批量导入前禁用刷新
curl -X PUT "localhost:9200/my_index/_settings?pretty" -H 'Content-Type: application/json' -d'
{
  "index": {
    "refresh_interval": "-1"
  }
}
'

# 批量导入后恢复刷新
curl -X PUT "localhost:9200/my_index/_settings?pretty" -H 'Content-Type: application/json' -d'
{
  "index": {
    "refresh_interval": "30s"
  }
}
'

查询性能优化​

# 使用过滤器上下文
curl -X GET "localhost:9200/my_index/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "bool": {
      "filter": [
        {"term": {"status": "published"}},
        {"range": {"publish_date": {"gte": "2023-01-01"}}}
      ]
    }
  }
}
'

# 限制返回字段
curl -X GET "localhost:9200/my_index/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match_all": {}
  },
  "_source": ["title", "author"]
}
'

Elasticsearch监控​

内置监控API​

# 集群健康状态
curl -X GET "localhost:9200/_cluster/health?pretty"

# 节点统计
curl -X GET "localhost:9200/_nodes/stats?pretty"

# 索引统计
curl -X GET "localhost:9200/_stats?pretty"

# 任务管理
curl -X GET "localhost:9200/_tasks?pretty"

Cat API​

# 查看索引列表
curl -X GET "localhost:9200/_cat/indices?v"

# 查看节点列表
curl -X GET "localhost:9200/_cat/nodes?v"

# 查看分片分布
curl -X GET "localhost:9200/_cat/shards?v"

# 查看集群健康
curl -X GET "localhost:9200/_cat/health?v"

# 查看节点分配
curl -X GET "localhost:9200/_cat/allocation?v"

Elasticsearch备份和恢复​

快照仓库配置​

# 创建共享文件系统仓库
curl -X PUT "localhost:9200/_snapshot/my_backup?pretty" -H 'Content-Type: application/json' -d'
{
  "type": "fs",
  "settings": {
    "location": "/mnt/backups/elasticsearch",
    "compress": true
  }
}
'

创建和恢复快照​

# 创建快照
curl -X PUT "localhost:9200/_snapshot/my_backup/snapshot_1?wait_for_completion=true&pretty"

# 创建包含特定索引的快照
curl -X PUT "localhost:9200/_snapshot/my_backup/snapshot_2?wait_for_completion=true&pretty" -H 'Content-Type: application/json' -d'
{
  "indices": "index_1,index_2",
  "ignore_unavailable": true,
  "include_global_state": false
}
'

# 查看快照
curl -X GET "localhost:9200/_snapshot/my_backup/snapshot_1?pretty"

# 恢复快照
curl -X POST "localhost:9200/_snapshot/my_backup/snapshot_1/_restore?pretty" -H 'Content-Type: application/json' -d'
{
  "indices": "index_1,index_2",
  "ignore_unavailable": true,
  "include_global_state": true,
  "rename_pattern": "index_(.+)",
  "rename_replacement": "restored_index_$1"
}
'

实践练习​

练习1：Elasticsearch安装和基本配置​

# 1. 安装Java
sudo apt update
sudo apt install openjdk-11-jdk

# 2. 安装Elasticsearch
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
sudo apt update
sudo apt install elasticsearch

# 3. 启动服务
sudo systemctl start elasticsearch
sudo systemctl enable elasticsearch
sudo systemctl status elasticsearch

# 4. 测试连接
curl -X GET "localhost:9200/?pretty"

练习2：索引和文档操作​

# 1. 创建索引
curl -X PUT "localhost:9200/books?pretty"

# 2. 创建文档
curl -X POST "localhost:9200/books/_doc/?pretty" -H 'Content-Type: application/json' -d'
{
  "title": "Elasticsearch实战",
  "author": "张三",
  "price": 89.00,
  "category": "技术",
  "tags": ["搜索", "大数据", "分析"]
}
'

curl -X POST "localhost:9200/books/_doc/?pretty" -H 'Content-Type: application/json' -d'
{
  "title": "Redis设计与实现",
  "author": "黄健宏",
  "price": 79.00,
  "category": "技术",
  "tags": ["缓存", "数据库", "NoSQL"]
}
'

# 3. 搜索文档
curl -X GET "localhost:9200/books/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match": {
      "title": "Elasticsearch"
    }
  }
}
'

# 4. 聚合查询
curl -X GET "localhost:9200/books/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "category_count": {
      "terms": {
        "field": "category.keyword"
      }
    }
  }
}
'

练习3：映射和搜索优化​

# 1. 创建带自定义映射的索引
curl -X PUT "localhost:9200/articles?pretty" -H 'Content-Type: application/json' -d'
{
  "mappings": {
    "properties": {
      "title": {
        "type": "text",
        "analyzer": "standard"
      },
      "content": {
        "type": "text",
        "analyzer": "standard"
      },
      "author": {
        "type": "keyword"
      },
      "publish_date": {
        "type": "date"
      },
      "views": {
        "type": "integer"
      }
    }
  }
}
'

# 2. 批量导入数据
curl -X POST "localhost:9200/articles/_bulk?pretty" -H 'Content-Type: application/json' -d'
{"index":{"_id":"1"}}
{"title":"Elasticsearch入门指南","content":"这是一篇关于Elasticsearch入门的文章","author":"张三","publish_date":"2023-01-01","views":100}
{"index":{"_id":"2"}}
{"title":"Redis缓存优化","content":"这是一篇关于Redis缓存优化的文章","author":"李四","publish_date":"2023-01-02","views":150}
'

# 3. 复杂搜索
curl -X GET "localhost:9200/articles/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "bool": {
      "should": [
        {"match": {"title": "Elasticsearch"}},
        {"match": {"content": "优化"}}
      ],
      "filter": [
        {"range": {"views": {"gte": 100}}},
        {"range": {"publish_date": {"gte": "2023-01-01"}}}
      ]
    }
  },
  "sort": [
    {"views": {"order": "desc"}},
    {"publish_date": {"order": "desc"}}
  ]
}
'

故障排除​

常见问题​

  1. 启动失败

    # 检查日志
    sudo tail -f /var/log/elasticsearch/elasticsearch.log

    # 检查内存配置
    grep -i "memory" /etc/elasticsearch/jvm.options

    # 检查文件描述符限制
    ulimit -n

  2. 内存不足

    # 查看堆内存使用
    curl -X GET "localhost:9200/_nodes/stats/jvm?pretty"

    # 调整JVM内存
    # 修改 /etc/elasticsearch/jvm.options
    -Xms1g
    -Xmx1g

  3. 性能问题

    # 查看慢查询日志
    curl -X GET "localhost:9200/_cluster/settings?pretty"

    # 查看分片分布
    curl -X GET "localhost:9200/_cat/shards?v"

    # 查看节点负载
    curl -X GET "localhost:9200/_nodes/stats/os?pretty"

通过掌握Elasticsearch数据库管理技能，你可以有效地在Linux系统上部署、配置和维护Elasticsearch搜索服务，为应用提供强大的搜索和分析能力。