[大数据]kibana es创建模板，索引，导入数据，简单聚合查询

1.创建模板

PUT _template/metering_template
{
		"index_patterns": ["df_*_metering"],
		"settings": {
			"number_of_shards": 1,
			"number_of_replicas": 1
		},
		"mappings": {
			"dynamic_templates": [//strings类型的字段设置为keyword
				{
					"strings_as_keywords": {
						"match_mapping_type": "string",
						"mapping": {
							"type": "keyword"
						}
					}
				}
			],
			"date_detection": false,//日期检测自动转换为日期类型关闭
			"properties": {
				"count": {//count字段设置为long
					"type": "long"
				},
				"time": {
					"type": "date"
				}
			}
		}
}

2.获取模板

GET _template/metering_template
{
  "metering_template" : {
    "order" : 0,
    "index_patterns" : [
      "df_*_metering"
    ],
    "settings" : {
      "index" : {
        "number_of_shards" : "1",
        "number_of_replicas" : "1"
      }
    },
    "mappings" : {
      "dynamic_templates" : [
        {
          "strings_as_keywords" : {
            "mapping" : {
              "type" : "keyword"
            },
            "match_mapping_type" : "string"
          }
        }
      ],
      "date_detection" : false,
      "properties" : {
        "count" : {
          "type" : "long"
        },
        "time" : {
          "type" : "date"
        }
      }
    },
    "aliases" : { }
  }
}

3.创建索引

PUT /df_test_metering

4.查看索引

GET /df_test_metering  //可以看到df_test_metering符合格式"index_patterns": ["df_*_metering"],所以匹配上面创建的模板
{
  "df_test_metering" : {
    "aliases" : { },
    "mappings" : {
      "dynamic_templates" : [
        {
          "strings_as_keywords" : {
            "match_mapping_type" : "string",
            "mapping" : {
              "type" : "keyword"
            }
          }
        }
      ],
      "date_detection" : false,
      "properties" : {
        "count" : {
          "type" : "long"
        },
        "project" : {
          "type" : "keyword"
        },
        "time" : {
          "type" : "date"
        }      }
    },
  }
}

5.导入数据

PUT /df_test_metering/_doc/3     //PUT导入数据需要指定id
{
   "project": "event",
   "count":  44,
   "time":"2022-03-29"
}

POST /df_test_metering/_doc     //POST导入数据系统分配id
{
   "project": "event",
   "count":  44,
   "time":"2022-03-29"
}

6.查看字段属性

GET /df_test_metering/_mapping
{
  "df_test_metering" : {
    "mappings" : {
      "dynamic_templates" : [
        {
          "strings_as_keywords" : {
            "match_mapping_type" : "string",
            "mapping" : {
              "type" : "keyword"
            }
          }
        }
      ],
      "date_detection" : false,
      "properties" : {
        "count" : {
          "type" : "long"
        },
        "project" : {//可以看到，project是string，因为dynamic_templates，所以识别为keyword
          "type" : "keyword"
        },
        "time" : {
          "type" : "date"
        }      }
    }
  }
}

7.查询数据

查询条件：
GET /df_test_metering/_search
{
  "aggs": {
		"count": {
			"aggs": {
				"sum_count": {
					"sum": {//max,min,value_count(count函数)函数
						"field": "count"
					}
				}
			},
			"terms": {//group by project
				"field": "project"
			}
		}
	},
	"size":0//设置为0，不返回_source
}
查询结果：
{
  "took" : 0,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 6,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]//因为查询添加size设置为0，索引不返回_source
  },
  "aggregations" : {
    "count" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "logging",
          "doc_count" : 3,
          "sum_count" : {
            "value" : 68.0
          }
        },
        {
          "key" : "event",
          "doc_count" : 2,
          "sum_count" : {
            "value" : 38.0
          }
        }
      ]
    }
  }
}