一、題目

在集群上有 task2 索引，請重建它到 task2_new 索引上，并滿足以下要求：

1. task2 索引的 a 字段包含有關鍵字 Yoo-Hoo 和 YooHoo，不管搜索 Yoo-Hoo 還是YooHoo 它們的結果應該一樣
2. task2_new 和 task2 的 mapping 應該一樣

POST task2/_bulk
{"index":{}}
{"a":"Yoo-Hoo"}
{"index":{}}
{"a":"YooHoo"}

1.1 考點

1. 分詞器

1.2 答案

# 創建索引結構，自定義分詞器
PUT task2_new
{"settings": {"analysis": {"analyzer": {"my_custom_analyzer": {"type": "custom","tokenizer": "standard","char_filter": ["remove-"],"filter": []}},"char_filter": {"remove-": {"type": "mapping","mappings": ["- => "]}}}},"mappings": {"properties": {"a":{"type": "text","analyzer": "my_custom_analyzer"}}}
}# 寫入數據
POST task2_new/_bulk
{"index":{}}
{"a":"Yoo-Hoo"}
{"index":{}}
{"a":"YooHoo"}# 驗證結果
GET task2_new/_search
{"query": {"match": {"a": "YooHoo"}}
}
GET task2_new/_search
{"query": {"match": {"a": "Yoo-Hoo"}}
}

二、題目

earthquakes 索引中包含了過去11個月的地震信息，請通過一句查詢，獲取以下信息

1. 過去11個月，每個月的平均地震等級(magnitude)
2. 過去11個月里，平均地震等級最高的一個月及其平均地震等級
3. 搜索不能返回任何文檔

# 創建索引
PUT earthquakes
{"settings": {"number_of_replicas": 0},"mappings": {"properties": {"timestamp": {"type": "date","format": "yyyy-MM-dd HH:mm:ss"},"magnitude": {"type": "float"}}}
}# 導入數據
POST earthquakes/_bulk
{"index":{}}
{"timestamp":"2012-01-01 12:12:12", "magnitude":4.56}
{"index":{}}
{"timestamp":"2012-01-01 15:12:12", "magnitude":6.46}
{"index":{}}
{"timestamp":"2012-02-02 13:12:12", "magnitude":4}
{"index":{}}
{"timestamp":"2012-03-02 13:12:12", "magnitude":6}
{"index":{}}
{"timestamp":"1967-03-02 13:12:12", "magnitude":6}

2.1 考點

1. 分桶聚類
2. 指標聚類
3. 管道聚類

2.2 答案

POST earthquakes/_search
{"size": 0,"aggs": {"every_month": {"date_histogram": {"field": "timestamp","calendar_interval": "month","format": "yyyy-MM-dd"},"aggs": {"avg_magnitude": {"avg": {"field": "magnitude"}}}},"max_magnitude": {"max_bucket": {"buckets_path": "every_month>avg_magnitude" }}}
}