### only focus on use

### abstraction layer separate the representation

### Elasticsearch 版本基于7.10

- data streams

```
数据流，需要一个index template
Each data stream requires a matching index template. The template contains the mappings and settings used to configure the stream’s backing indices.

数据流文档，需要一个@timestamp字段
Every document indexed to a data stream must contain a @timestamp field, mapped as a date or date_nanos field type. If the index template doesn’t specify a mapping for the @timestamp field, Elasticsearch maps @timestamp as a date field with default options.
```

- search data

Documents that match a search’s queries are returned in the hits, or search results, of the response.

You can use the search API to search and aggregate data stored in Elasticsearch data streams or indices. 

```
curl -X GET "localhost:9200/my-index-000001/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match": {
      "user.id": "kimchy"
    }
  }
}
'

```

```
You can use the following options to customize your searches.

Query DSL
Query DSL supports a variety of query types you can mix and match to get the results you want. Query types include:

    Boolean and other compound queries, which let you combine queries and match results based on multiple criteria
    Term-level queries for filtering and finding exact matches
    Full text queries, which are commonly used in search engines
    Geo and spatial queries
Aggregations
You can use search aggregations to get statistics and other analytics for your search results. Aggregations help you answer questions like:

    What’s the average response time for my servers?
    What are the top IP addresses hit by users on my network?
    What is the total transaction revenue by customer?
```

```
叶子查询
Leaf query clauses
Leaf query clauses look for a particular value in a particular field, such as the match, term or range queries. These queries can be used by themselves.
组合查询
Compound query clauses
Compound query clauses wrap other leaf or compound queries and are used to combine multiple queries in a logical fashion (such as the bool or dis_max query), or to alter their behaviour (such as the constant_score query).
行为不同，依据是在query中使用，还是在flter中使用
Query clauses behave differently depending on whether they are used in query context or filter context.
```

```
dsl

query
In the query context, a query clause answers the question “How well does this document match this query clause?” 

filter：主要用于结构化数据
In a filter context, a query clause answers the question “Does this document match this query clause?” The answer is a simple Yes or No
 - Does this timestamp fall into the range 2015 to 2016?
 - Is the status field set to "published"?
 
curl -X GET "localhost:9200/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": { 
    "bool": { 
      "must": [
        { "match": { "title":   "Search"        }},
        { "match": { "content": "Elasticsearch" }}
      ],
      "filter": [ 
        { "term":  { "status": "published" }},
        { "range": { "publish_date": { "gte": "2015-01-01" }}}
      ]
    }
  }
}
'

bool query（重点）
The default query for combining multiple leaf or compound query clauses, as must, should, must_not, or filter clauses. The must and should clauses have their scores combined — the more matching clauses, the better — while the must_not and filter clauses are executed in filter context.

boosting query
Return documents which match a positive query, but reduce the score of documents which also match a negative query.
constant_score query
A query which wraps another query, but executes it in filter context. All matching documents are given the same “constant” _score.
dis_max query
A query which accepts multiple queries, and returns any documents which match any of the query clauses. While the bool query combines the scores from all matching queries, the dis_max query uses the score of the single best- matching query clause.
function_score query
Modify the scores returned by the main query with functions to take into account factors like popularity, recency, distance, or custom algorithms implemented with scripting.

```

```
三者相等
curl -X GET "localhost:9200/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "bool": {
      "filter": {
        "term": {
          "status": "active"
        }
      }
    }
  }
}
'

curl -X GET "localhost:9200/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "bool": {
      "must": {
        "match_all": {}
      },
      "filter": {
        "term": {
          "status": "active"
        }
      }
    }
  }
}
'

curl -X GET "localhost:9200/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "constant_score": {
      "filter": {
        "term": {
          "status": "active"
        }
      }
    }
  }
}
'

```

```
match query
是一个标准的query
The match query is the standard query for performing a full-text search,

match参数为字段
字段的参数为：query、analyzer。。。。
query参数：
This means the match query can search text fields for analyzed tokens rather than an exact term.

curl -X GET "localhost:9200/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match": {
      "message": "this is a test"
    }
  }
}
'

```