First of all, DON’T PANIC. It will take 5 minutes to get the gist of what Elasticsearch is all about.
http://localhost:9200/ to verify Elasticsearch is running.
First, index some sample JSON documents. The first request automatically creates
the my-index-000001 index.
curl -X POST 'http://localhost:9200/my-index-000001/_doc?pretty' -H 'Content-Type: application/json' -d '
{
"@timestamp": "2099-11-15T13:12:00",
"message": "GET /search HTTP/1.1 200 1070000",
"user": {
"id": "kimchy"
}
}'
curl -X POST 'http://localhost:9200/my-index-000001/_doc?pretty' -H 'Content-Type: application/json' -d '
{
"@timestamp": "2099-11-15T14:12:12",
"message": "GET /search HTTP/1.1 200 1070000",
"user": {
"id": "elkbee"
}
}'
curl -X POST 'http://localhost:9200/my-index-000001/_doc?pretty' -H 'Content-Type: application/json' -d '
{
"@timestamp": "2099-11-15T01:46:38",
"message": "GET /search HTTP/1.1 200 1070000",
"user": {
"id": "elkbee"
}
}'
Next, use a search request to find any documents with a user.id of kimchy.
curl -X GET 'http://localhost:9200/my-index-000001/_search?q=user.id:kimchy&pretty=true'
You can also retrieve all documents in my-index-000001.
curl -X GET 'http://localhost:9200/my-index-000001/_search?pretty=true' -H 'Content-Type: application/json' -d '
{
"query" : {
"match_all" : {}
}
}'
During indexing, Elasticsearch automatically mapped the @timestamp field as a
date. This lets you run a range search.
curl -X GET 'http://localhost:9200/my-index-000001/_search?pretty=true' -H 'Content-Type: application/json' -d '
{
"query" : {
"range" : {
"@timestamp": {
"from": "2099-11-15T13:00:00",
"to": "2099-11-15T14:00:00"
}
}
}
}'
Elasticsearch supports multiple indices. The previous examples used an index
called my-index-000001. You can create another index, my-index-000002, to
store additional data when my-index-000001 reaches a certain age or size. You
can also use separate indices to store different types of data.
You can configure each index differently. The following request
creates my-index-000002 with two primary shards rather than the default of
one. This may be helpful for larger indices.
curl -X PUT 'http://localhost:9200/my-index-000002?pretty' -H 'Content-Type: application/json' -d '
{
"settings" : {
"index.number_of_shards" : 2
}
}'
You can then add a document to my-index-000002.
curl -X POST 'http://localhost:9200/my-index-000002/_doc?pretty' -H 'Content-Type: application/json' -d '
{
"@timestamp": "2099-11-16T13:12:00",
"message": "GET /search HTTP/1.1 200 1070000",
"user": {
"id": "kimchy"
}
}'
You can search and perform other operations on multiple indices with a single
request. The following request searches my-index-000001 and my-index-000002.
curl -X GET 'http://localhost:9200/my-index-000001,my-index-000002/_search?pretty=true' -H 'Content-Type: application/json' -d '
{
"query" : {
"match_all" : {}
}
}'
You can omit the index from the request path to search all indices.
curl -X GET 'http://localhost:9200/_search?pretty=true' -H 'Content-Type: application/json' -d '
{
"query" : {
"match_all" : {}
}
}'
Let’s face it, things will fail....
Elasticsearch is a highly available and distributed search engine. Each index is broken down into shards, and each shard can have one or more replicas. By default, an index is created with 1 shard and 1 replica per shard (1/1). There are many topologies that can be used, including 1/10 (improve search performance), or 20/1 (improve indexing performance, with search executed in a map reduce fashion across shards).
In order to play with the distributed nature of Elasticsearch, simply bring more nodes up and shut down nodes. The system will continue to serve requests (make sure you use the correct http port) with the latest data indexed.
We have just covered a very small portion of what Elasticsearch is all about. For more information, please refer to the Elastic Forum or Building from source
Elasticsearch uses TESTING for more information about running the Elasticsearch test suite.
In order to ensure a smooth upgrade process from earlier versions of Elasticsearch, please see our /tensor-core/elasticsearch