一、题目

原索引 task1 的字段 title 字段包含单词 The，查询 the 可以查出 1200 篇文档。重建 task1 索引为 task1_new，重建后的索引， title 字段查询 the 单词，不能匹配到任何文档。

PUT task1
{
  "mappings": {
    "properties": {
      "title": {
        "type": "text"
      }
    }
  }
}

# 灌入数据
POST task1/_bulk
{"index": {}}
{"title": "the name"}
{"index": {}}
{"title": "the sex"}
{"index": {}}
{"title": "The age"}
{"index": {}}
{"title": "height"}

# 检查查询结果
GET task1/_search
{
  "query": {
    "match": {
      "title": "the"
    }
  }
}

1.1 考点

1. 分词器里面的停用词

1.2 答案

# 新建索引结构，自定义分词器
PUT task1_new
{
  "settings": {
    "analysis": {
      "analyzer": {
        "my_custom_analyzer": { 
          "char_filter": [],
          "tokenizer": "standard",
          "filter": [
            "my_custom_stop_words_filter"
          ]
        }
      },
      "filter": {
        "my_custom_stop_words_filter": {
          "type": "stop",
          "ignore_case": true,
          "stopwords": ["the" ]
        }
      }
    }
  },
  "mappings": {
    "properties": {
      "title": {
        "type": "text",
        "analyzer": "my_custom_analyzer"
      }
    }
  }
}

# 向新索引灌入数据
POST _reindex
{
  "source": {
    "index": "task1"
  },
  "dest": {
    "index": "task1_new"
  }
}

# 检查查询结果
GET task1_new/_search
{
  "query": {
    "match": {
      "title": "The"
    }
  }
}

二、题目

索引 kibana_sample_data_flights 包含了大量的航班信息，以此写出满足以下条件的查询语句：

1. 对美国的航班信息按照城市分组，找出平均航班延迟时间最高的城市

{
  "FlightNum": "XLL6LDF",
  "DestCountry": "ZA",
  "OriginWeather": "Thunder & Lightning",
  "OriginCityName": "Jebel Ali",
  "AvgTicketPrice": 642.5951482867853,
  "DistanceMiles": 3942.7713488567097,
  "FlightDelay": false,
  "DestWeather": "Damaging Wind",
  "Dest": "OR Tambo International Airport",
  "FlightDelayType": "No Delay",
  "OriginCountry": "AE",
  "dayOfWeek": 4,
  "DistanceKilometers": 6345.275413654453,
  "timestamp": "2024-05-10T06:09:09",
  "DestLocation": {
    "lat": "-26.1392",
    "lon": "28.246"
  },
  "DestAirportID": "JNB",
  "Carrier": "Logstash Airways",
  "Cancelled": false,
  "FlightTimeMin": 302.15597207878346,
  "Origin": "Al Maktoum International Airport",
  "OriginLocation": {
    "lat": "24.896356",
    "lon": "55.161389"
  },
  "DestRegion": "SE-BD",
  "OriginAirportID": "DWC",
  "OriginRegion": "SE-BD",
  "DestCityName": "Johannesburg",
  "FlightTimeHour": 5.035932867979724,
  "FlightDelayMin": 0
}

2.1 考点

1. Boolean
2. 聚合

2.2 答案

GET kibana_sample_data_flights/_search
{
  "size": 0, 
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "DestCountry": {
              "value": "US"
            }
          }
        },
        {
          "term": {
            "FlightDelay": {
              "value": "true"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "DestCityName_bucket": {
       "terms": { "field": "DestCityName" },
       "aggs": {
          "avg_FlightDelayMin": { "avg": { "field": "FlightDelayMin" } }
       }
    },
    "max_monthly_sales": {
      "max_bucket": {
        "buckets_path": "DestCityName_bucket>avg_FlightDelayMin" 
      }
    }
  }
}