使用kibana实现es索引的数据映射和索引模版/组件模版

1 数据映射

数据映射官方链接

1.1 日期映射案例

1.创建一条索引。把索引中的字段生日映射为日期，并制定映射后的格式为年月日

PUT http://10.0.0.91:9200/zhiyong18-luckyboy-date
{"mappings": {"properties": {"birthday": {"type":   "date","format": "yyyy-MM-dd"}}}
}

2.创建测试数据，因为使用了 “” 后，默认是文本类型。

POST  http://10.0.0.91:9200/_bulk
{ "create": { "_index": "zhiyong18-luckyboy-date"} }
{ "name": "wzy","birthday": "2000-10-01" }
{ "create": { "_index": "zhiyong18-luckyboy-date"} }
{ "name": "XiaoWen","birthday": "2018-05-01" }
{ "create": { "_index": "zhiyong18-luckyboy-date"} }
{ "name": "老文","birthday": "1996-05-01" }

展开索引管理即可看到该索引的映射情况

在这里插入图片描述

3.查看年龄，从大到小降序排序(注意，比较的是数字，数字大的在下面)

GET 10.0.0.91:9200/zhiyong18-luckyboy-date/_search
{"sort": { "birthday": "asc"} 
}

输出结果：

可以看到原本是文本的类型的日期也可以按照大小排序了

{"took": 870,"timed_out": false,"_shards": {"total": 1,"successful": 1,"skipped": 0,"failed": 0},"hits": {"total": {"value": 3,"relation": "eq"},"max_score": null,"hits": [{"_index": "zhiyong18-luckyboy-date","_type": "_doc","_id": "-g-qMJMBE9HPwNvdRhWJ","_score": null,"_source": {"name": "老文","birthday": "1996-05-01"},"sort": [830908800000]},{"_index": "zhiyong18-luckyboy-date","_type": "_doc","_id": "-A-qMJMBE9HPwNvdRhWJ","_score": null,"_source": {"name": "wzy","birthday": "2000-10-01"},"sort": [970358400000]},{"_index": "zhiyong18-luckyboy-date","_type": "_doc","_id": "-Q-qMJMBE9HPwNvdRhWJ","_score": null,"_source": {"name": "XiaoWen","birthday": "2018-05-01"},"sort": [1525132800000]}]}
}

1.2 IP映射案例

1.自定义数据类型和创建索引。把ip_addr映射为ip地址

PUT 10.0.0.91:9200/zhiyong18-luckyboy-ip
{"mappings": {"properties": {"ip_addr": {"type": "ip"}}},"settings": {"number_of_shards": 3,"number_of_replicas": 0}
}

2.写入测试数据

POST 10.0.0.91:9200/_bulk
{ "create": { "_index": "zhiyong18-luckyboy-ip"} }
{ "ip_addr": "192.168.10.101" }          
{ "create": { "_index": "zhiyong18-luckyboy-ip"} }
{ "ip_addr": "192.168.10.201" }          
{ "create": { "_index": "zhiyong18-luckyboy-ip"} }
{ "ip_addr": "172.31.10.100" }           
{ "create": { "_index": "zhiyong18-luckyboy-ip"} }
{ "ip_addr": "10.0.0.222" }              
{ "create": { "_index": "zhiyong18-luckyboy-ip"} }
{ "ip_addr": "192.168.20.91" }
{ "create": { "_index": "zhiyong18-luckyboy-ip"} }
{ "ip_addr": "10.0.0.93" }

3.查看网段192.168.0.0/16

GET 10.0.0.91:9200/zhiyong18-luckyboy-ip/_search
{"query": {"match" : {"ip_addr": "192.168.0.0/16"}}
}

输出：

{"took": 932,"timed_out": false,"_shards": {"total": 3,"successful": 3,"skipped": 0,"failed": 0},"hits": {"total": {"value": 3,"relation": "eq"},"max_score": 1.0,"hits": [{"_index": "zhiyong18-luckyboy-ip","_type": "_doc","_id": "zf3PMJMBCz6n20zoIPU9","_score": 1.0,"_source": {"ip_addr": "192.168.10.101"}},{"_index": "zhiyong18-luckyboy-ip","_type": "_doc","_id": "zv3PMJMBCz6n20zoIPU9","_score": 1.0,"_source": {"ip_addr": "192.168.10.201"}},{"_index": "zhiyong18-luckyboy-ip","_type": "_doc","_id": "0f3PMJMBCz6n20zoIPU9","_score": 1.0,"_source": {"ip_addr": "192.168.20.91"}}]}
}

1.3 地理位置映射案例

1.创建索引。在 zhiyong18-map 索引中为 location 字段创建了 geo_point 类型的映射，使location字段可以存储地理坐标（经纬度）。随后，可以使用 ES 提供的地理空间查询功能，进行基于位置的查询操作

PUT http://10.0.0.93:9200/zhiyong18-map
{"mappings": {"properties": {"location": { "type": "geo_point"}}}
}

2.写入地理位置；lat：表示纬度（Latitude）；lon：表示经度（Longitude）。

POST http://10.0.0.93:9200/_bulk
{ "create": { "_index": "zhiyong18-map"}}
{ "location": { "lat": 39.914,"lon": 116.386}}
{ "create": { "_index": "zhiyong18-map"}}
{ "location": { "lat": 42.210,"lon": 101.666}}
{ "create": { "_index": "zhiyong18-map"}}
{ "location": { "lat": 32.850,"lon": 98.124}}
{ "create": { "_index": "zhiyong18-map"}}
{ "location": { "lat": 79.850,"lon": 128.124}}
{ "create": { "_index": "zhiyong18-map"}}
{ "location": { "lat": 63.850,"lon": 179.124}}

3.去创建一条索引模式匹配创建的索引：zhiyong18-map（略）

位置： Management 窗口 --> Stack Management --> kibana --> 索引模式，创建zhiyong18-map

4.创建地理位置图：Analytics --> Maps --> 点击右侧的添加图层 --> 选择文档在这里插入图片描述
–> 选择索引模式 (zhiyong18-map)

在这里插入图片描述

2 kibana的组件/索引模版

2.1 创建组件模版

窗口位置：在这里插入图片描述

1.在运筹创建一个组件模版 luckyboy

2.索引设置：在这里插入图片描述

3.设置各种映射，有兴趣可以自行研究在这里插入图片描述

4.别名设置，K8S、database、ELK。在这里插入图片描述

5.复查阶段。其实就是查看一下json有没有问题和看看多了哪些设置

在这里插入图片描述

查看json内存，是不是非常熟悉。其实就是kibana把要写的json做成前端了，大大降低了使用门槛

PUT _component_template/luckyboy
{"template": {"settings": {"number_of_replicas": 0,"number_of_shards": 8},"mappings": {"properties": {"ip_addr": {"type": "ip"},"birthday": {"type": "date"},"jingweidu": {"type": "geo_shape"}}},"aliases": {"K8S": {},"database": {},"ELK": {}}}
}

2.2 创建索引模版

窗口位置：在这里插入图片描述

1.创建一条索引模版：lucky-wzy，设置索引模式：lucky-wzy*

数据流参考链接：https://www.elastic.co/guide/en/elasticsearch/reference/7.17/data-streams.html

在这里插入图片描述

2.引用上一步【kibana相关使用案例–>创建组件模版】的组件模版：lucky-boy

在这里插入图片描述

3.索引设置，略。（因为组件模版中已经定义了）

4.映射，略。（因为组件模版中已经定义了）

5.别名，略。（因为组件模版中已经定义了）

6.复查。查看即将创建的索引模版

PUT _index_template/lucky-wzy
{"index_patterns": ["lucky-wzy*"],"composed_of": ["luckyboy"]
}

2.3 创建索引引用索引&组件模版

1.创建一条索引 lucky-wzy-01 验证之前的操作

PUT 10.0.0.91:9200/lucky-wzy-01

2.查看该条索引符合之前的设置预期

GET 10.0.0.91:9200/lucky-wzy-01

{"lucky-wzy-01": {"aliases": {"ELK": {},"K8S": {},"database": {}},"mappings": {"properties": {"birthday": {"type": "date","format": "yyyy-MM-dd"},"ip_addr": {"type": "ip"},"jingweidu": {"type": "geo_shape"}}},"settings": {"index": {"routing": {"allocation": {"include": {"_tier_preference": "data_content"}}},"number_of_shards": "8","provided_name": "lucky-wzy-01","creation_date": "1731751518739","number_of_replicas": "0","uuid": "PDS3MbFHQ6u0YDPviRIHqg","version": {"created": "7172299"}}}}
}}}},"number_of_shards": "8","provided_name": "lucky-wzy-01","creation_date": "1731751518739","number_of_replicas": "0","uuid": "PDS3MbFHQ6u0YDPviRIHqg","version": {"created": "7172299"}}}}
}