⚡ Elasticsearch Cheat Sheet
增删改查常见用法速查
包含索引管理、新增、查询、更新、删除及运维进阶的常用 DSL 与 API 用例。点击卡片右下角的「复制」即可直接使用于 Kibana Dev Tools 或 Curl 终端。
目标索引名
快捷设置:
修改后，下方全部代码样例中的 products 将自动实时替换。
M
索引管理 (Index Management)
8 个样例PUT创建索引并定义映射指定字段类型与分词器
PUT /products
{
"settings": {
"number_of_shards": 1,
"number_of_replicas": 1
},
"mappings": {
"properties": {
"name": { "type": "text", "analyzer": "ik_max_word" },
"category": { "type": "keyword" },
"price": { "type": "double" },
"stock": { "type": "integer" },
"created_at": { "type": "date" }
}
}
}建表前显式定义 mapping，避免字段类型推断错误
GET查看索引设置与映射诊断字段类型与配置
# 查看单个索引的 mapping
GET /products/_mapping
# 查看索引 settings
GET /products/_settings
# 在终端快速查看所有索引概览
GET /_cat/indices?v_cat API 极其适合在命令行终端快速排查集群状态
HEAD判断索引是否存在存在返回 200，否则 404
HEAD /products自动化脚本中常用它来幂等地初始化索引
DELETE删除索引高危操作，慎用
DELETE /products
# 支持通配符批量删除
DELETE /logs-*生产环境强烈建议禁止全局/通配符索引删除指令
PUT为索引增加别名alias 指向具体索引
# 方式一：直接给单个索引加别名
PUT /products/_alias/prod
# 方式二：通过 _aliases 动作（可带过滤/路由）
POST /_aliases
{
"actions": [
{ "add": { "index": "products", "alias": "prod" } }
]
}别名可被读写直接调用，是实现零停机切索引的核心手段
DELETE移除索引别名解绑 alias 指向
# 方式一：直接删除某个别名
DELETE /products/_alias/prod
# 方式二：通过 _aliases 动作移除
POST /_aliases
{
"actions": [
{ "remove": { "index": "products", "alias": "prod" } }
]
}只解绑别名，绝对不会影响底层物理索引数据
POST原子切换别名旧索引解绑 + 新索引无缝绑定
POST /_aliases
{
"actions": [
{ "remove": { "index": "products_v1", "alias": "prod" } },
{ "add": { "index": "products_v2", "alias": "prod" } }
]
}同一个请求中原子执行，保证无任何瞬间别名为空
GET同时查看 settings 与 mapping一键读取全部配置
# 直接查索引，响应同时包含 settings / mappings / aliases
GET /products
# 仅查看 settings 与 mappings 两项
GET /products/_settings,_mappings
# 查看全部索引的别名分布
GET /_cat/aliases?v排查环境最常用：一份响应即可览清全部字段与索引配置
C
新增 (Create)
3 个样例PUT指定文档 ID 新增幂等写入操作
PUT /products/_doc/1001
{
"name": "无线机械键盘",
"category": "外设",
"price": 299.0,
"stock": 120,
"created_at": "2026-07-21"
}若该 ID 已存在，再次 PUT 会整体全量覆盖原文档
POST自动生成 ID 新增不需要显式指定 _id
POST /products/_doc
{
"name": "人体工学椅",
"category": "家具",
"price": 899.0,
"stock": 30,
"created_at": "2026-07-21"
}ES 服务端会自动为此文档生成唯一的字符串 _id
POST批量新增 (Bulk)高效写入大量数据
POST /_bulk
{ "index": { "_index": "products", "_id": "1002" } }
{ "name": "4K 显示器", "category": "显示器", "price": 1599.0, "stock": 55 }
{ "index": { "_index": "products", "_id": "1003" } }
{ "name": "降噪耳机", "category": "音频", "price": 799.0, "stock": 80 }Bulk 格式严格要求每行结尾包含换行符（含最后一行）
R
查询 (Read)
8 个样例GET按 ID 查询文档精准主键读取
GET /products/_doc/1001若主键不存在将返回 found: false
GETmatch 全文检索基于 text 字段分词匹配
GET /products/_search
{
"query": {
"match": {
"name": "机械键盘"
}
}
}match 会先对查询词做分词，适合文本搜索
GETterm 精确匹配适合 keyword 或数值类型
GET /products/_search
{
"query": {
"term": {
"category": "外设"
}
}
}term 不做分词，目标字段建议设为 keyword
GETrange 范围查询数值与时间区间过滤
GET /products/_search
{
"query": {
"range": {
"price": { "gte": 100, "lte": 1000 }
}
}
}gte/lte 包含边界条件，gt/lt 为不包含
GETbool 组合条件must / filter / must_not 组合
GET /products/_search
{
"query": {
"bool": {
"must": [ { "match": { "name": "键盘" } } ],
"filter": [ { "range": { "price": { "gte": 100 } } } ],
"must_not":[ { "term": { "category": "二手" } } ]
}
}
}filter 子句不计算相关性得分（_score），可被缓存提升性能
GET分页、排序与字段过滤from / size / sort / _source
GET /products/_search
{
"from": 0,
"size": 10,
"sort": [ { "price": { "order": "desc" } } ],
"_source": [ "name", "price", "stock" ],
"query": { "match_all": {} }
}from + size 默认最大上限为 10000，深分页推荐使用 search_after
GET聚合统计 (aggs)分组、平均值、最大值
GET /products/_search
{
"size": 0,
"aggs": {
"by_category": {
"terms": { "field": "category", "size": 10 },
"aggs": {
"avg_price": { "avg": { "field": "price" } }
}
}
}
}设置 size: 0 表示仅返回聚合分析数据，不返回原始文档
GET模糊匹配 (wildcard / fuzzy)通配符与拼写容错
# 通配符匹配
GET /products/_search
{ "query": { "wildcard": { "name": "*键*" } } }
# 容错匹配：允许最多 2 个字符编辑距离差异
GET /products/_search
{ "query": { "fuzzy": { "name": { "value": "键盘", "fuzziness": 2 } } } }fuzzy 非常适合纠正错别字或拼写错误场景
U
更新 (Update)
5 个样例POST局部更新文档仅修改指定字段
POST /products/_update/1001
{
"doc": {
"price": 279.0,
"stock": 95
}
}仅更新 doc 对象中的指定属性，保持未提及属性原样
POST不存在则新增 (upsert)实现写入/更新幂等
POST /products/_update/1009
{
"doc": { "name": "智能台灯", "stock": 10 },
"doc_as_upsert": true
}开启 doc_as_upsert，若文档不存在则直接自动新增
POST脚本更新 (painless)原位计算与增减
POST /products/_update/1001
{
"script": {
"source": "ctx._source.stock += params.inc",
"lang": "painless",
"params": { "inc": 5 }
}
}用 Painless 脚本直接增减数值，有效避免先查后写并发冲突
POST批量更新 (Bulk)多条文档局部修改
POST /_bulk
{ "update": { "_index": "products", "_id": "1001" } }
{ "doc": { "stock": 90 }, "doc_as_upsert": true }
{ "update": { "_index": "products", "_id": "1002" } }
{ "doc": { "stock": 50 }, "doc_as_upsert": true }Bulk update 中每条更新指令由元信息与 doc 载荷两行构成
POST按查询更新 (_update_by_query)条件批量更新
POST /products/_update_by_query
{
"script": {
"source": "ctx._source.category = '促销'",
"lang": "painless"
},
"query": { "range": { "price": { "lt": 300 } } }
}对于超大索引更新，可搭配 slices 参数并行提升吞吐效率
D
删除 (Delete)
3 个样例DELETE按 ID 删除文档精准主键删除
DELETE /products/_doc/1001响应返回 result: "deleted" 表示成功
POST按查询删除 (_delete_by_query)条件批量清理数据
POST /products/_delete_by_query
{
"query": { "range": { "stock": { "lte": 0 } } }
}示例用于批量清除所有库存为 0 的失效文档
POST批量删除 (Bulk)多条指定 ID 一次清除
POST /_bulk
{ "delete": { "_index": "products", "_id": "1002" } }
{ "delete": { "_index": "products", "_id": "1003" } }Bulk delete 每条指令仅需要一行 action 元数据即可
A
进阶操作 (Advanced & Ops)
11 个样例PUT修改默认窗口大小 (max_result_window)调整 from+size 分页上限
PUT /products/_settings
{
"index.max_result_window": 100000
}默认上限 10000；非必要不建议盲目放大，深分页建议选用 search_after
PUT动态调整副本数量分片数不可变，副本随时调
PUT /products/_settings
{
"index.number_of_replicas": 2
}主分片创建后不可直接增减，副本数可动态扩展提升读高并发
POST重建索引 (_reindex)修改 Mapping 或主分片后数据迁移
POST /_reindex
{
"source": { "index": "products" },
"dest": { "index": "products_new" }
}如需改字段类型必须新建索引并 reindex；加上 "conflicts":"proceed" 可跳过冲突
POST零停机无缝换 Mapping新建 + Reindex + 原子切换别名
# 1) 创建带有新 mapping 的目标索引
PUT /products_v2
{ "mappings": { "properties": { "name": { "type": "text" } } } }
# 2) 迁移历史数据
POST /_reindex
{ "source": { "index": "products_v1" }, "dest": { "index": "products_v2" } }
# 3) 原子性无缝切换别名（瞬间完成）
POST /_aliases
{
"actions": [
{ "remove": { "index": "products_v1", "alias": "prod" } },
{ "add": { "index": "products_v2", "alias": "prod" } }
]
}生产环境最标准的字段升级流程，完全无需中断线上业务
POST分词调试 (_analyze)查看 analyzer 拆词逻辑
POST /products/_analyze
{
"analyzer": "ik_max_word",
"text": "无线机械键盘"
}高效调试“为什么搜不到”的必备接口，亦可使用自定义 tokenizer 测试
PUT索引模板 (_index_template)新建索引自动套用 Mapping
PUT /_index_template/products_tpl
{
"index_patterns": [ "products*" ],
"template": {
"settings": { "number_of_shards": 1 },
"mappings": {
"properties": { "created_at": { "type": "date" } }
}
}
}匹配 products* 的新增索引将自动应用此配置与映射
GET游标深分页 (search_after)替代常规 from+size 深度翻页
GET /products/_search
{
"size": 10,
"sort": [ { "price": "asc" }, { "_id": "asc" } ],
"search_after": [ 299.0, "1001" ]
}无深分页性能瓶颈，需保证排序字段组合唯一（如带上 _id）
POST滚动查询 (scroll)海量数据一次性导出
# 1) 首次查询建立 scroll 游标上下文（存活 1 分钟）
POST /products/_search?scroll=1m
{ "size": 1000, "query": { "match_all": {} } }
# 2) 持续读取后续页面
POST /_search/scroll
{ "scroll": "1m", "scroll_id": "DXF1ZXJ5QW5kaW..." }
# 3) 完成后手动清除上下文
DELETE /_search/scroll
{ "scroll_id": "DXF1ZXJ5QW5kaW..." }极其适合大批量离线导数；用毕后及时手动释放资源
POST刷新与强制合并 (refresh / forcemerge)Segment 段优化
# 手动刷新，使刚写入的文档立即可被检索
POST /products/_refresh
# 强制合并 Lucene 段（建议在只读索引上运行）
POST /products/_forcemerge?max_num_segments=1forcemerge 资源消耗较大，适合归档索引或者停止写入的索引
GET运行时字段 (runtime field)免修改 Mapping 动态计算
GET /products/_search
{
"runtime_mappings": {
"price_with_tax": {
"type": "double",
"script": "emit(doc['price'].value * 1.13)"
}
},
"fields": [ "price_with_tax" ]
}不需要重建索引，即可在查询期以脚本方式算出新属性
GET集群健康与索引开关集群与索引运维监控
# 等待集群达到了解指定健康状态
GET /_cluster/health?wait_for_status=yellow
# 关闭/重新打开索引（释放内存与句柄，数据保留）
POST /products/_close
POST /products/_open_close 能迅速释放堆内存资源，需要读写时再执行 _open 恢复