一、基本概念
1 Node 与 Cluster
Elastic 本质上是一个分布式数据库，允许多台服务器协同工作，每台服务器可以运行多个 Elastic 实例。单个 Elastic 实例称为一个节点（node）。一组节点构成一个集群（cluster）。
2 Index
Elastic 会索引所有字段，经过处理后写入一个反向索引（Inverted Index）。查找数据的时候，直接查找该索引。
所以，Elastic 数据管理的顶层单位就叫做 Index（索引）。它是单个数据库的同义词。每个 Index （即数据库）的名字必须是小写
3 Document
Index 里面单条的记录称为 Document（文档）。许多条 Document 构成了一个 Index。
Document 使用 JSON 格式表示。同一个 Index 里面的 Document，不要求有相同的结构（scheme），但是最好保持相同，这样有利于提高搜索效率。
4 Type
Document 可以分组，比如weather这个 Index 里面，可以按城市分组（北京和上海），也可以按气候分组（晴天和雨天）。这种分组就叫做 Type，它是虚拟的逻辑分组，用来过滤 Document。
不同的 Type 应该有相似的结构（schema），举例来说，id字段不能在这个组是字符串，在另一个组是数值。这是与关系型数据库的表的一个区别。性质完全不同的数据（比如products和logs）应该存成两个 Index，而不是一个 Index 里面的两个 Type（虽然可以做到）。
根据规划，Elastic 6.x 版只允许每个 Index 包含一个 Type，7.x 版将会彻底移除 Type。
二、操作
1：查看ES版本信息
1[elk@es logs]$ curl -GET 'http://localhost:9250' 2{ 3 "name" : "elk01", 4 "cluster_name" : "elk-cluster", 5 "cluster_uuid" : "KW6Nr_pTSVuwT0gR0agtOA", 6 "version" : { 7 "number" : "5.3.1", 8 "build_hash" : "5f9cf58", 9 "build_date" : "2017-04-17T15:52:53.846Z", 10 "build_snapshot" : false, 11 "lucene_version" : "6.4.2" 12 }, 13 "tagline" : "You Know, for Search" 14} 15[elk@es logs]$
ES返回一个json文本信息，包括版本、当前节点、集群等等信息
默认情况下，Elastic 只允许本机访问，如果需要远程访问，可以修改 Elastic 安装目录的config/elasticsearch.yml文件，去掉network.host的注释，将它的值改
0.0.0.0，然后重新启动 Elastic。
上面代码中，设成0.0.0.0让任何人都可以访问。线上服务不要这样设置，要设成具体的 IP。
2：查看索引列表
1[elk@es logs]$ curl -X GET 'http://localhost:9250/_cat/indices?v' 2health status index uuid pri rep docs.count docs.deleted store.size pri.store.size 3yellow open textindex r8Mj0h23TBO6uP6tBLGylQ 5 1 0 0 650b 650b 4[elk@es logs]$
此处返回我刚创建的一个索引(创建步骤下面叙述),具体各个含义值，可以使用help查看
1[elk@es logs]$ curl -X GET 'http://localhost:9250/_cat/indices?help' 2health | h | current health status 3status | s | open/close status 4index | i,idx | index name 5uuid | id,uuid | index uuid 6pri | p,shards.primary,shardsPrimary | number of primary shards 7rep | r,shards.replica,shardsReplica | number of replica shards 8docs.count | dc,docsCount | available docs 9docs.deleted | dd,docsDeleted | deleted docs 10creation.date | cd | index creation date (millisecond value) 11creation.date.string | cds | index creation date (as string) 12store.size | ss,storeSize | store size of primaries & replicas 13pri.store.size | | store size of primaries 14completion.size | cs,completionSize | size of completion 15pri.completion.size | | size of completion 16fielddata.memory_size | fm,fielddataMemory | used fielddata cache 17pri.fielddata.memory_size | | used fielddata cache 18fielddata.evictions | fe,fielddataEvictions | fielddata evictions 19pri.fielddata.evictions | | fielddata evictions 20query_cache.memory_size | qcm,queryCacheMemory | used query cache 21pri.query_cache.memory_size | | used query cache 22query_cache.evictions | qce,queryCacheEvictions | query cache evictions 23pri.query_cache.evictions | | query cache evictions 24request_cache.memory_size | rcm,requestCacheMemory | used request cache 25pri.request_cache.memory_size | | used request cache 26request_cache.evictions | rce,requestCacheEvictions | request cache evictions 27pri.request_cache.evictions | | request cache evictions 28request_cache.hit_count | rchc,requestCacheHitCount | request cache hit count 29pri.request_cache.hit_count | | request cache hit count 30request_cache.miss_count | rcmc,requestCacheMissCount | request cache miss count 31pri.request_cache.miss_count | | request cache miss count 32flush.total | ft,flushTotal | number of flushes 33pri.flush.total | | number of flushes 34flush.total_time | ftt,flushTotalTime | time spent in flush 35pri.flush.total_time | | time spent in flush 36get.current | gc,getCurrent | number of current get ops 37pri.get.current | | number of current get ops 38get.time | gti,getTime | time spent in get 39pri.get.time | | time spent in get 40get.total | gto,getTotal | number of get ops 41pri.get.total | | number of get ops 42get.exists_time | geti,getExistsTime | time spent in successful gets 43pri.get.exists_time | | time spent in successful gets 44get.exists_total | geto,getExistsTotal | number of successful gets 45pri.get.exists_total | | number of successful gets 46get.missing_time | gmti,getMissingTime | time spent in failed gets 47pri.get.missing_time | | time spent in failed gets 48get.missing_total | gmto,getMissingTotal | number of failed gets 49pri.get.missing_total | | number of failed gets 50indexing.delete_current | idc,indexingDeleteCurrent | number of current deletions 51pri.indexing.delete_current | | number of current deletions 52indexing.delete_time | idti,indexingDeleteTime | time spent in deletions 53pri.indexing.delete_time | | time spent in deletions 54indexing.delete_total | idto,indexingDeleteTotal | number of delete ops 55pri.indexing.delete_total | | number of delete ops 56indexing.index_current | iic,indexingIndexCurrent | number of current indexing ops 57pri.indexing.index_current | | number of current indexing ops 58indexing.index_time | iiti,indexingIndexTime | time spent in indexing 59pri.indexing.index_time | | time spent in indexing 60indexing.index_total | iito,indexingIndexTotal | number of indexing ops 61pri.indexing.index_total | | number of indexing ops 62indexing.index_failed | iif,indexingIndexFailed | number of failed indexing ops 63pri.indexing.index_failed | | number of failed indexing ops 64merges.current | mc,mergesCurrent | number of current merges 65pri.merges.current | | number of current merges 66merges.current_docs | mcd,mergesCurrentDocs | number of current merging docs 67pri.merges.current_docs | | number of current merging docs 68merges.current_size | mcs,mergesCurrentSize | size of current merges 69pri.merges.current_size | | size of current merges 70merges.total | mt,mergesTotal | number of completed merge ops 71pri.merges.total | | number of completed merge ops 72merges.total_docs | mtd,mergesTotalDocs | docs merged 73pri.merges.total_docs | | docs merged 74merges.total_size | mts,mergesTotalSize | size merged 75pri.merges.total_size | | size merged 76merges.total_time | mtt,mergesTotalTime | time spent in merges 77pri.merges.total_time | | time spent in merges 78refresh.total | rto,refreshTotal | total refreshes 79pri.refresh.total | | total refreshes 80refresh.time | rti,refreshTime | time spent in refreshes 81pri.refresh.time | | time spent in refreshes 82refresh.listeners | rli,refreshListeners | number of pending refresh listeners 83pri.refresh.listeners | | number of pending refresh listeners 84search.fetch_current | sfc,searchFetchCurrent | current fetch phase ops 85pri.search.fetch_current | | current fetch phase ops 86search.fetch_time | sfti,searchFetchTime | time spent in fetch phase 87pri.search.fetch_time | | time spent in fetch phase 88search.fetch_total | sfto,searchFetchTotal | total fetch ops 89pri.search.fetch_total | | total fetch ops 90search.open_contexts | so,searchOpenContexts | open search contexts 91pri.search.open_contexts | | open search contexts 92search.query_current | sqc,searchQueryCurrent | current query phase ops 93pri.search.query_current | | current query phase ops 94search.query_time | sqti,searchQueryTime | time spent in query phase 95pri.search.query_time | | time spent in query phase 96search.query_total | sqto,searchQueryTotal | total query phase ops 97pri.search.query_total | | total query phase ops 98search.scroll_current | scc,searchScrollCurrent | open scroll contexts 99pri.search.scroll_current | | open scroll contexts 100search.scroll_time | scti,searchScrollTime | time scroll contexts held open 101pri.search.scroll_time | | time scroll contexts held open 102search.scroll_total | scto,searchScrollTotal | completed scroll contexts 103pri.search.scroll_total | | completed scroll contexts 104segments.count | sc,segmentsCount | number of segments 105pri.segments.count | | number of segments 106segments.memory | sm,segmentsMemory | memory used by segments 107pri.segments.memory | | memory used by segments 108segments.index_writer_memory | siwm,segmentsIndexWriterMemory | memory used by index writer 109pri.segments.index_writer_memory | | memory used by index writer 110segments.version_map_memory | svmm,segmentsVersionMapMemory | memory used by version map 111pri.segments.version_map_memory | | memory used by version map 112segments.fixed_bitset_memory | sfbm,fixedBitsetMemory | memory used by fixed bit sets for nested object field types and type filters for types referred in _parent fields 113pri.segments.fixed_bitset_memory | | memory used by fixed bit sets for nested object field types and type filters for types referred in _parent fields 114warmer.current | wc,warmerCurrent | current warmer ops 115pri.warmer.current | | current warmer ops 116warmer.total | wto,warmerTotal | total warmer ops 117pri.warmer.total | | total warmer ops 118warmer.total_time | wtt,warmerTotalTime | time spent in warmers 119pri.warmer.total_time | | time spent in warmers 120suggest.current | suc,suggestCurrent | number of current suggest ops 121pri.suggest.current | | number of current suggest ops 122suggest.time | suti,suggestTime | time spend in suggest 123pri.suggest.time | | time spend in suggest 124suggest.total | suto,suggestTotal | number of suggest ops 125pri.suggest.total | | number of suggest ops 126memory.total | tm,memoryTotal | total used memory 127pri.memory.total | | total user memory 128[elk@es logs]$
3：创建索引
1[elk@es logs]$ curl -X PUT 'localhost:9250/abctest' 2{"acknowledged":true,"shards_acknowledged":true} 3[elk@es logs]$
创建索引名称，必须是小写，并且索引名称一旦创建，则不可以修改，acknowledged表示执行结果，true或false
4：删除索引
删除索引，只需要将PUT替换为DELETE即可
1[elk@es logs]$ curl -X DELETE 'localhost:9250/abctest' 2{"acknowledged":true} 3[elk@es logs]$