PUT iis_test #新建名为iis_test的索引
DELETE iis_test #删除名为iis_test的索引
GET iis_test/_mapping #查看名为iis_test的索引映射
POST iis_test/_doc #在名为iis_test的索引中插入一条数据
{
"EventTime":"2016-07-17T12:58:17.136+0800",
"c-ip":"191.168.3.35"
}
#重建索引（实际是新增一个索引出来）
POST _reindex
{
"source": {
"index": "iis_oa_2020-09"
},
"dest": {
"index": "iis_oa_1_2020-09"
}
}
GET _template/template_iis #查询名为template_iis的模板
DELETE _template/template_iis #删除名为template_iis的模板
#新建名为template_iis的模板
PUT _template/template_iis
{
"index_patterns" : [
"iis*"
],
"settings" : {
"index" : {
"number_of_shards" : 1,
"number_of_replicas":2,
"refresh_interval" : "5s"
}
},
"mappings" : {
"_doc" : {
"dynamic_templates" : [
{
"message_field" : {
"path_match" : "message",
"match_mapping_type" : "string",
"mapping" : {
"type" : "text",
"norms" : false
}
}
},
{
"string_fields" : {
"match" : "*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "text",
"norms" : false,
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
],
"properties" : {
"@timestamp" : {
"type" : "date"
},
"@version" : {
"type" : "keyword"
},
"EventTime" : {
"type" : "date"
},
"c-ip" : {
"type" : "ip"
},
"s-ip" : {
"type" : "ip"
},
"geoip" : {
"dynamic" : true,
"properties" : {
"ip" : {
"type" : "ip"
},
"location" : {
"type" : "geo_point"
},
"latitude" : {
"type" : "half_float"
},
"longitude" : {
"type" : "half_float"
}
}
}
}
}
},
"aliases" : { }
}