引言
Kibana是一个针对Elasticsearch的开源数据分析及可视化平台，用来搜索、查看交互存储在Elasticsearch索引中的数据。使用Kibana，可以通过各种图表进行高级数据分析及展示。
Kibana让海量数据更容易理解。它操作简单，基于浏览器的用户界面可以快速创建仪表板（dashboard）实时显示Elasticsearch查询动态。
设置Kibana非常简单。无需编码或者额外的基础架构，几分钟内就可以完成Kibana安装并启动Elasticsearch索引监测。
安装配置
Linux环境安装
[root@localhost ~]# tar -zxvf kibana-6.4.0-linux-x86_64.tar.gz
[root@localhost ~]# cd /usr/kibana-6.4.0-linux-x86_64/
[root@localhost kibana-6.4.0-linux-x86_64]# vim config/kibana.yml
# To allow connections from remote users, set this parameter to a non-loopback address.
# 输入你在内网的本机IP地址
server.host: "192.168.23.141"
# The URL of the Elasticsearch instance to use for all your queries.
elasticsearch.url: "http://192.168.23.141:9200"
[root@localhost kibana-6.4.0-linux-x86_64]# bin/kibana
Windows环境安装
进入kibana的bin目录，双击kibana.bat
输入地址：http://内网本机ip:5601
启动测试
Kibana操作指南
一、使用Kibana实现ES基本的操作
进入kibana开发测试工具界面
查看集群
- 查看集群健康信息
GET /_cat/health?v
集群状态（status）
Green（正常）
Yellow（正常，但是一些副本还没有分配）
Red（非正常）
可以使用GET /_cat/health?help查看每个操作返回结果字段的意义
注意：
这里的GET是RESTful API的请求方式
/_cat/health?help是RESTful API接口
你也可以使用PostMan这样的RESTful API测试工具，但是没有提示
使用方式如下：
- 查看集群中节点信息
GET /_cat/nodes?v
ip heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name
192.168.23.141 9 91 7 0.10 0.08 0.13 mdi * x0vIhEF
- 查看集群中的索引信息
GET /_cat/indices?v
health status index uuid pri rep docs.count docs.deleted store.size
yellow open baizhi BYzhTHMzQIKEiyaKXklueQ 5 1 0 0 1.2kb
简化写法
GET /_cat/indices?v&h=health,status,index
health status index
yellow open baizhi
索引操作
- 创建索引
PUT /baizhi
#! Deprecation: the default number of shards will change from [5] to [1] in 7.0.0; if you wish to continue using the default of [5] shards, you must manage this on the create index request or with an index template
{
"acknowledged": true, # 创建成功返回true
"shards_acknowledged": true,
"index": "baizhi"
}
上面的操作使用默认的配置信息创建一个索引
- 删除索引
DELETE /baizhi
{
"acknowledged": true
}
- 创建类型
Mapping
PUT /baizhi # 创建index(baizhi)并添加类型mapping（_doc）
{
"mappings": {
"_doc": {
"properties": {
"title": { "type": "text" }, # 注意： 字符串常用类型：text类型会分词 keyword类型不会分词
"name": { "type": "text" },
"age": { "type": "integer" },
"created": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
}
}
或者
POST /baizhi/user # 创建index(baizhi)后，在指定index中添加类型mapping(user)
{
"user": {
"properties": {
"id": { "type": "text" },
"name": { "type": "text" },
"age": { "type": "integer" },
"created": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
}
Mapping Type：
查看类型mapping
GET /baizhi/_mapping/_doc # 语法：GET /索引名/_mapping/类型名
-------------------------------------------
{
"baizhi": {
"mappings": {
"_doc": {
"properties": {
"age": {
"type": "integer"
},
"created": {
"type": "date"
},
"name": {
"type": "text"
},
"title": {
"type": "text"
}
}
}
}
}
}
文档操作
- 新增单个文档
PUT /baizhi/_doc/1 # put /索引名/类型名/id
{ # request body
"name":"zs",
"title":"张三",
"age":18,
"created":"2018-12-25"
}
或
POST /baizhi/_doc
{
"name":"ls",
"title":"李四",
"age":28,
"created":"2018-12-26"
}
-------------------------------------------------------------
{
"_index": "baizhi",
"_type": "_doc",
"_id": "KbOj6GcBVEuCC3JSh18Y", # ES自动生成的文档的id
"_version": 1,
"result": "created",
"_shards": {
"total": 2,
"successful": 1,
"failed": 0
},
"_seq_no": 0,
"_primary_term": 1
}
- 查询单个文档
GET /baizhi/_doc/1 # 语法： GET /索引名/类型名/id
-------------------------------------------------------------------
{
"_index": "baizhi",
"_type": "_doc",
"_id": "1",
"_version": 1,
"found": true,
"_source": {
"name": "zs",
"title": "张三",
"age": 18,
"created": "2018-12-25"
}
}
GET /baizhi/_doc/KbOj6GcBVEuCC3JSh18Y
--------------------------------------------------------------------
{
"_index": "baizhi",
"_type": "_doc",
"_id": "KbOj6GcBVEuCC3JSh18Y",
"_version": 1,
"found": true,
"_source": {
"name": "ls",
"title": "李四",
"age": 28,
"created": "2018-12-26"
}
}
- 修改单个文档
PUT /baizhi/_doc/KbOj6GcBVEuCC3JSh18Y # 语法： PUT /索引名/类型名/id
{
"name":"lxs",
"title":"李小四"
}
--------------------------------------------------------------------
{
"_index": "baizhi",
"_type": "_doc",
"_id": "KbOj6GcBVEuCC3JSh18Y",
"_version": 2,
"found": true,
"_source": {
"name": "lxs",
"title": "李小四"
}
}
- 删除单个文档
DELETE /baizhi/_doc/1 # 语法： DELETE /索引名/类型名/id
--------------------------------------------------------------------
{
"_index": "baizhi",
"_type": "_doc",
"_id": "1",
"_version": 2,
"result": "deleted",
"_shards": {
"total": 2,
"successful": 1,
"failed": 0
},
"_seq_no": 1,
"_primary_term": 1
}
批处理操作
除了能够索引、更新和删除单个文档外，Elasticsearch还提供了使用_bulk API批量执行上述任何操作的能力。这个功能非常重要，因为它提供了一种非常有效的机制，可以以尽可能少的网络往返尽可能快地执行多个操作
POST /baizhi/_doc/_bulk # 批量插入多个document
{"index":{}}
{"name":"ww","title":"王五","age":18,"created":"2018-12-27"}
{"index":{}}
{"name":"zl","title":"赵六","age":25,"created":"2018-12-27"}
-------------------------------------------------------------------
{
"took": 65,
"errors": false, # 批量插入成功
"items": [
{
"index": {
"_index": "baizhi",
"_type": "_doc",
"_id": "KrOP6WcBVEuCC3JS8V9K",
"_version": 1,
"result": "created",
"_shards": {
"total": 2,
"successful": 1,
"failed": 0
},
"_seq_no": 0,
"_primary_term": 1,
"status": 201
}
},
{
"index": {
"_index": "baizhi",
"_type": "_doc",
"_id": "K7OP6WcBVEuCC3JS8V9K",
"_version": 1,
"result": "created",
"_shards": {
"total": 2,
"successful": 1,
"failed": 0
},
"_seq_no": 0,
"_primary_term": 1,
"status": 201
}
}
]
}
POST /baizhi/_doc/_bulk # 批量操作（包含修改和删除）
{"update":{"_id":"KrOP6WcBVEuCC3JS8V9K"}} # 修改
{"doc":{"title":"王小五"}}
{"delete":{"_id":"K7OP6WcBVEuCC3JS8V9K"}} # 删除
