Elasticsearch 入門實戰：安裝配置、常見坑與基礎 CRUD 操作

環境準備與常見坑

坑 1：max file descriptors 過低

ERROR: max file descriptors [1024] for elasticsearch process likely too low, increase to at least [65536]

錯誤做法：ulimit -n 65536 臨時修改，重啟失效

正確做法：永久修改 /etc/security/limits.conf

# 末尾新增
* soft nofile 65536
* hard nofile 65536
root soft nofile 65536
root hard nofile 65536

重新登入生效，ulimit -a 驗證

坑 2：max virtual memory areas 過低

ERROR: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

# /etc/sysctl.conf
vm.max_map_count=262144
# 立即生效
sysctl -p

坑 3：root 用戶直接啟動

Elasticsearch 禁止 root 啟動，需建立專用用戶：

useradd esuser
passwd esuser
chown -R esuser:esuser /opt/elasticsearch
su - esuser -c "/opt/elasticsearch/bin/elasticsearch -d"

基礎 CRUD 操作 (REST API)

建立索引

# 建立 customer 索引
curl -XPUT 'localhost:9200/customer?pretty'

# 回應
{
  "acknowledged" : true,
  "shards_acknowledged" : true,
  "index" : "customer"
}

查看所有索引

curl -XGET 'localhost:9200/_cat/indices?v&pretty'

# 回應範例
health status index    uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   customer xxxxxxxxxxxxxxxxxxxxxx   5   1          0            0       260b           260b

新增文檔 (指定 ID)

curl -XPUT 'localhost:9200/customer/external/1?pretty' -H 'Content-Type: application/json' -d'
{
  "name": "John Doe"
}'

新增文檔 (自動生成 ID)

curl -XPOST 'localhost:9200/customer/external?pretty' -H 'Content-Type: application/json' -d'
{
  "name": "Jane Doe"
}'

查詢文檔

curl -XGET 'localhost:9200/customer/external/1?pretty'

更新文檔 (局部更新)

curl -XPOST 'localhost:9200/customer/external/1/_update?pretty' -H 'Content-Type: application/json' -d'
{
  "doc": { "name": "Jane Doe Updated" }
}'

刪除文檔

curl -XDELETE 'localhost:9200/customer/external/1?pretty'

刪除索引

curl -XDELETE 'localhost:9200/customer?pretty'

請求語法規範

<REST Verb> /<Index>/<Type>/<ID>

# 範例
PUT    /customer/external/1     # 建立/覆蓋 ID=1
POST   /customer/external       # 新增 (自動 ID)
GET    /customer/external/1     # 查詢
POST   /customer/external/1/_update # 部分更新
DELETE /customer/external/1     # 刪除文檔
DELETE /customer                # 刪除整個索引

生產環境關鍵配置 (elasticsearch.yml)

cluster.name: my-es-cluster
node.name: node-1
network.host: 0.0.0.0
http.port: 9200
transport.tcp.port: 9300

# 記憶體鎖定 (防止 swap)
bootstrap.memory_lock: true

# 發現機制
discovery.seed_hosts: ["10.0.0.1", "10.0.0.2"]
cluster.initial_master_nodes: ["node-1", "node-2"]

# 堆內存設定 (JVM 選項 -Xms -Xmax 不超過物理記憶體 50%)
# /etc/elasticsearch/jvm.options
-Xms2g
-Xmx2g

常用查詢 DSL 範例

Match Query (全文搜尋)

curl -XGET 'localhost:9200/customer/_search?pretty' -H 'Content-Type: application/json' -d'
{
  "query": {
    "match": { "name": "John" }
  }
}'

Term Query (精確匹配)

curl -XGET 'localhost:9200/customer/_search?pretty' -H 'Content-Type: application/json' -d'
{
  "query": {
    "term": { "status": "active" }
  }
}'

Bool Query (組合查詢)

curl -XGET 'localhost:9200/customer/_search?pretty' -H 'Content-Type: application/json' -d'
{
  "query": {
    "bool": {
      "must": [ { "match": { "name": "John" } } ],
      "filter": [ { "term": { "status": "active" } } ],
      "must_not": [ { "range": { "age": { "lt": 18 } } } ]
    }
  }
}'

總結

Elasticsearch 入門核心：系統參數調優 (ulimit, vm.max_map_count) → 專用用戶啟動 → REST API 基礎 CRUD → DSL 查詢語法。生產部署需關注叢集規劃、記憶體配置、分片副本策略、監控告警與備份恢復機制。