1. 在cluster1上有一task1索引,请编写一个查询并满足以下要求: runtime fields+range aggs.
   ● 定义一个名为a的运行时字段，通过a字段实现以下聚合（a字段的值等于b字段减去c字段）
   ● 聚合a值小于-2的文档
   ● 聚合-5到5之间的文档
   ● 聚合大于5的文档
   ● 建立测试索引

PUT task1
{"settings": {"number_of_replicas": 0,"number_of_shards": 1,"index.routing.allocation.require.my_node_type": "hot"},"mappings": {"properties": {"b": {"type": "long"},"c": {"type": "long"}}}
}POST task1/_bulk
{"index":{"_id":1}}
{"b":5,"c":6}
{"index":{"_id":2}}
{"b":5,"c":1}
{"index":{"_id":3}}
{"b":8,"c":1}
{"index":{"_id":4}}
{"b":5,"c":8}

PUT task1/_mapping
{"runtime":{"a":{"type":"long","script":{"source":"emit(doc['b'].value - doc['c'].value)"}}}
}POST task1/_search?size=0
{"aggs": {"range_a": {"range": {"field": "a","ranges": [{"to":-2},{"from": -5,"to": 5},{"from": 5}]}}}
}

2. analyzer+reindex。在集群一上有task2索引，请重建它到task2_new索引上，并满足以下要求：
   ● 集群一的title字段包含有关键字’yoo-hoo’和’yoohoo’,不管搜索’yoohoo’还是’yoo-hoo’,它们的结果应该一样
   ● task2_new和task2的mapping应该一样

PUT task2
{"settings": {"number_of_replicas": 0,"number_of_shards": 1},"mappings": {"properties": {"title":{"type": "text"}}}
}
POST task2/_doc/1
{"title":"Yoo-Hoo"}
POST task2/_doc/2
{"title":"YooHoo"}

PUT task2_new
{"settings": {"analysis": {"analyzer": {"my_analyzer":{"char_filter":["my_char_filter"],"tokenizer":"standard","filter":["lowercase"]}},"char_filter": {"my_char_filter":{"type":"mapping","mappings":["-=>"]}}}},"mappings": {"properties": {"title":{"type": "text","analyzer": "my_analyzer"}}}
}POST /_reindex
{"source": {"index": "task2"},"dest": {"index": "task2_new"}
}POST task2_new/_search
{"query": {"match": {"title": "yoohoo"}}
}

3. 数据流+索引生命周期管理。

   ● 现有以下文档，请编写一个名为test_data_stream数据流满足以下请求：

   {"@timestamp": "2099-03-08T11:04:05.000Z","message": "test"
   }
   

   ● 数据流索引的主分片数为3，副本分片数为1
   ● 将上述文档填充到数据流中去

ILM配置，建议直接通过kibana 配置

PUT _ilm/policy/my_exam2_policy
{"policy": {"phases": {"hot": {"min_age": "1d","actions": {"set_priority": {"priority": 100},"rollover": {"max_age": "7d","max_docs": 1000,"max_size": "5gb"}}},"warm": {"min_age": "1d","actions": {"set_priority": {"priority": 50},"allocate": {"number_of_replicas": 1,"include": {"_name": "","_ip": ""},"exclude": {"_name": "","_ip": ""},"require": {"_name": "","_ip": "","my_node_type":"warm"}},"shrink": {"number_of_shards": 1},"forcemerge": {"max_num_segments": 1}}},"cold": {"min_age": "1d","actions": {"set_priority": {"priority": 0},"freeze": {},"allocate": {"number_of_replicas": 1,"include": {"_name": "","_ip": ""},"exclude": {"_name": "","_ip": ""},"require": {"_name": "","_ip": "","my_node_type":"cold"}}}}}}
}

PUT _component_template/my_component_template_exam2
{"template": {"settings": {"index.lifecycle.name":"my_exam2_policy","index.number_of_shards":3,"index.number_of_replicas":1},"mappings": {"properties": {"@timestamp":{"type": "date"},"message":{"type": "text"}}}}
}

//使用 composed_of，方便编写 mapping 的内容
PUT _index_template/my_index_template_exam2
{"index_patterns": ["test_data_stream*"],"data_stream": { },"composed_of": [ "my_component_template_exam2" ],"priority": 500
}//使用 op_type=create，向 datastream 写入数据
POST test_data_stream/_doc/1?op_type=create
{"@timestamp":"2099-03-08T11:04:05.000Z","message":"test"}

4. CCR，把cluster1上的一个索引，复制到cluster2上

5. 查询模板
   ● 对task5编写一个查询模板，并满足以下要求：
   ● 使用a_01参数查询’a’字段；
   ● 使用start_date和end_date参数范围查询timestamp字段
   ● 如果没有提供end_date字段，那么结束时间默认是现在
   ● 查询结果中b字段必须equals’b’,
   ● 查询2018年6月1日到现在的数据，a字段包含关键字’aaa’

DELETE task5
PUT task5
{"mappings": {"properties": {"a":{"type": "text"},"b":{"type": "keyword"},"timestamp":{"type": "date"}}}
}POST /task5/_doc/1
{"a":"aaa AAA", "b":"b", "timestamp":"2021-11-11T11:21:21.000Z"}

PUT _scripts/my-search-template
{"script": {"lang": "mustache","source": {"query": {"bool": {"must": [{"match": {"a": "aaa"}},{"term": {"b": "b"}}],"should": [{"match": {"a": "{{a_01}}"}},{"range": {"timestamp": {"gte": "{{start_date}}","lte": "{{end_date}}{{^end_date}}now{{/end_date}}"}}}]}}}}
}GET task5/_search/template
{"id": "my-search-template","params": {"a_01": "aaa","start_date": "2018-06-01"}
}

6. earthquakes索引中包含了过去11个月的地震信息，请通过一句查询，获取以下信息
   ● 过去11个月，每个月的平均地震等级(magiitude)
   ● 过去11个月里，平均地震等级最高的一个月及其平均地震等级
   ● 搜索不能返回任何文档

DELETE earthquakesPUT earthquakes
{"settings":{"number_of_replicas":0,"number_of_shards":1},"mappings":{"properties": {"earth_date":{"type": "date"},"magiitude":{"type": "float"}}}
}POST earthquakes/_bulk
{"index":{"_id":1}}
{"earth_date":"2012-01-01","magiitude": 4.5}
{"index":{"_id":2}}
{"earth_date":"2012-02-01","magiitude": 5.5}
{"index":{"_id":3}}
{"earth_date":"2012-03-01","magiitude": 5.5}
{"index":{"_id":4}}
{"earth_date":"2012-04-01","magiitude": 6.5}
{"index":{"_id":5}}
{"earth_date":"2012-04-02","magiitude": 7.5}
{"index":{"_id":6}}
{"earth_date":"2012-05-01","magiitude": 4.5}
{"index":{"_id":7}}
{"earth_date":"2012-06-01","magiitude": 3.2}
{"index":{"_id":8}}
{"earth_date":"2012-07-01","magiitude": 4.2}
{"index":{"_id":9}}
{"earth_date":"2012-08-01","magiitude": 5.2}
{"index":{"_id":10}}
{"earth_date":"2012-09-01","magiitude": 5.5}
{"index":{"_id":11}}
{"earth_date":"2012-10-01","magiitude": 3.5}
{"index":{"_id":12}}
{"earth_date":"2012-10-02","magiitude": 4.5}

POST earthquakes/_search?size=0
{"aggs": {"bucket_month": {"date_histogram": {"field": "earth_date","calendar_interval": "month","format": "yyyy-MM-dd"},"aggs": {"avg_magiitude": {"avg": {"field": "magiitude"}}}},"avg_magiitude_all":{"avg": {"field": "magiitude"}},"max_avg_magiitude_by_month":{"max_bucket": {"buckets_path": "bucket_month>avg_magiitude"}}}
}

7. 目前有个索引是task3，用oa、OA、Oa、oA phrase查询是3条，使用dingding的phrase查询是2条，通过reindex 索引后能够使得使用oa、OA、Oa、oA、0A、dingding都是6条。

PUT task3
{"settings": {"number_of_replicas": 0},"mappings": {"properties": {"title": {"type": "text"}}}
}POST task3/_bulk
{"index":{}}
{"title":"oa"}
{"index":{}}
{"title":"OA"}
{"index":{}}
{"title":"Oa"}
{"index":{}}
{"title":"oA"}
{"index":{}}
{"title":"0A"}
{"index":{}}
{"title":"dingding"}

PUT task3_new
{"settings": {"number_of_replicas": 0,"analysis": {"analyzer": {"my_analyzer": {"tokenizer": "standard","filter": ["my_filter","lowercase"]}},"filter": {"my_filter": {"type": "synonym","synonyms": ["oa,OA,Oa,oA,0A,dingding"]}}}},"mappings": {"properties": {"title": {"type": "text","analyzer": "my_analyzer"}}}
}POST /_reindex
{"source": {"index": "task3"},"dest": {"index": "task3_new"}
}POST task3_new/_search
{"query": {"match": {"title": "oa"}}
}

8. 索引 movie-1，保存的电影信息，title是题目，tags是电影的标签。

   ● 在title中包含“my”或者“me”。
   ● 如果在tags中包含"romatic movies"，该条算分提高，如果不包含则算分不变
   知识点：自定义评分

PUT movie-1
{"mappings": {"properties": {"title":{"type": "text"},"tags":{"type": "keyword"}}}
}
POST movie-1/_doc/1
{"title":"my me", "tags":["romatic movies"]}

POST movie-1/_search
{"query": {"function_score": {"query": {"bool": {"should": [{"match": {"title": "my"}},{"match": {"title": "me"}}]}},"functions": [{"filter": {"term": {"tags": "romatic movies"}},"weight": 5}]}}
}

9. 对集群一上的task9索引编写一个查询，并满足以下要求：
   ● ‘a’,‘b’,‘c’字段至少有两个字段匹配中’test’关键字
   ● 对查询结果进行排序，先按照’a’字段进行降序排序，再按照’_socre’进行升序排序
   ● 'a’字段的返回结果高亮显示，前标签是,后标签是

PUT task9
{"mappings": {"properties": {"a":{"type": "keyword"},"b":{"type": "text"},"c":{"type": "text"}}}
}

POST task9/_search
{"query": {"bool": {"should": [{"match": {"a": "test"}},{"match": {"b": "test"}},{"match": {"c": "test"}}],"minimum_should_match": 2}},"highlight": {"fields": {"a":{"pre_tags": [""],"post_tags": [""]}}},"sort": [{"a": {"order": "desc"}},{"_score":{"order": "asc"}}]
}