1、题目

定义一个数据流，满足 data-stream_*_*，数据首先分布在 data_hot，5分钟后移动到 data_warm，3分钟后到 data_cold，再过 8 分钟删除。

1.1 考点

1. 生命周期
2. 索引模板
3. 数据流

1.2 答案

# 修改生命周期策略修改时间
PUT /_cluster/settings
{"persistent": {"indices.lifecycle.poll_interval": "1m"},"transient": {"indices.lifecycle.poll_interval": "1m"}
}# 创建策略
PUT _ilm/policy/policy_8m
{"policy": {"phases": {"hot": {"min_age": "0ms","actions": {}}, "warm": {"min_age": "1m","actions": {}},"delete": {"min_age": "2m","actions": {"delete": {}}}}}
}# 创建模板
PUT _index_template/policy_8m_template
{"index_patterns": ["data-stream_*_*"],"template": {"settings": {"number_of_shards": 3,"index.lifecycle.name": "policy_8m"}},"data_stream": { },"priority": 500
}# 创建一个数据流
PUT _data_stream/data-stream_05_27# 向数据流写入数据
PUT data-stream_05_27/_bulk
{ "create":{ } }
{ "@timestamp": "2099-05-06T16:21:15.000Z", "message": "192.0.2.42 - - [06/May/2099:16:21:15 +0000] \"GET /images/bg.jpg HTTP/1.0\" 200 24736" }
{ "create":{ } }
{ "@timestamp": "2099-05-06T16:25:42.000Z", "message": "192.0.2.255 - - [06/May/2099:16:25:42 +0000] \"GET /favicon.ico HTTP/1.0\" 200 3638" }

注： 数据流至少对应一个隐藏索引

2、题目

有一个索引 task2，存在 field2 字段，用 match 匹配 the 能查到很多数据，现要求对 task2 索引进行重建，达到使用 match 匹配 the 不能查询到数据的目的。

# 创建符合条件的 task2 索引，设置 field2 字段，并写入数据，简单查询
PUT task2
{"mappings": {"properties": {"field2":{"type": "text"}}}
}POST task2/_bulk
{"index": {}}
{"field2":"the school"}
{"index": {}}
{"field2":"the apple"}
{"index": {}}
{"field2":"the world"}GET task2/_search
{"query": {"match": {"field2": "the"}}
}

2.1 考点

1. match匹配查询
2. 分词器的使用
   • 2.1 Character filters： 字符过滤器
   • 2.2 Tokenizer： 分词器
   • 2.3 Token filter： 词过滤器
3. 索引重建

3.2 答案

# 定义索引 task3，自定义分词器 my_custom_analyzer，
PUT task3
{"settings": {"analysis": {"analyzer": {"my_custom_analyzer": { "char_filter": [ ],"tokenizer": "standard","filter": ["lowercase","english_stop"]}},"char_filter": {"emoticons": { "type": "mapping","mappings": ["the => "]}},"filter": {"english_stop": { "type": "stop","stopwords": [ "the" ]}}}},"mappings": {"properties": {"field2": {"type": "text","analyzer": "my_custom_analyzer"}}}
}# 重建索引 task2 的数据 到 task3
POST _reindex
{"source": {"index": "task2"},"dest": {"index": "task3"}
}# 查询
GET task3/_search
GET task3/_search
{"query": {"match": {"field2": "the"}}
}