7.4.1-elasticsearch索引元字段

_id字段

表示doc的唯一标识,且该字段要求长度在512字节以内;
_id字段对应的值可以通过条件查询(term,terms,match,query_string,simple_query_string)进行检索;

//定义mapping
PUT identity_id_index
{
   
  "mappings": {
   
    "properties": {
   
      "text":{
   
        "type": "text"
      }
    }
  }
}

PUT identity_id_index/_doc/1
{
   
  "text":"doc with id 1"
}

PUT identity_id_index/_doc/2
{
   
  "text":"doc with id 2"
}
//可根据_id字段使用terms查询
GET identity_id_index/_search
{
   
  "query": {
   
    "terms":{
   
      "_id":["1","2"]
    }
  }
}

_id字段值可以进行排序和聚合操作,但是如此做会加载大量数据到内存中,一般不建议这样做;若存在排序和聚合操作的场景,可以在doc中额外定义一个字段(doc_values为true),该字段值与_id字段值相同;

//额外定义一个字段id,其值与id字段值相同
PUT identity_id_dup_index
{
   
  "mappings": {
   
    "properties": {
   
      "text":{
   
        "type": "text"
      },
      "id":{
   
        "type": "keyword"
      }
    }
  }
}

PUT identity_id_index/_doc/1
{
   
  "text":"doc with id 1",
  "id":1

你可能感兴趣的:(ELK,elasticsearch)