Elasticsearch Cheatsheet: Essentiële opdrachten & tips

Elasticsearch-opdrachten voor zoekacties, indexering & analytische bewerkingen

Inhoud

Elasticsearch is een krachtige gedistribueerde zoek- en analytische engine gebaseerd op Apache Lucene. Deze uitgebreide cheat sheet behandelt essentiële opdrachten, best practices en snelle verwijzingen voor het werken met Elasticsearch clusters.

elasticsearch

Opmerking: De meeste voorbeelden in deze gids gebruiken cURL voor HTTP-aanvragen. Als je nieuw bent met cURL of een snelle verwijzing nodig hebt voor geavanceerde opties, raadpleeg dan onze cURL Cheat Sheet voor gedetailleerde technieken voor HTTP-aanvragen via de opdrachtprompt.

Clusterbeheer

Clusterstatus controleren

Alle opdrachten in deze sectie gebruiken cURL om te communiceren met Elasticsearch’s REST API. Je kunt deze aanvragen aanpassen met extra headers, authenticatie en andere opties indien nodig.

# Basisstatuscheck
curl -X GET "localhost:9200/_cluster/health?pretty"

# Gedetailleerde clusterstatus met schijfgegevens
curl -X GET "localhost:9200/_cluster/health?level=shards&pretty"

# Node-informatie controleren
curl -X GET "localhost:9200/_cat/nodes?v"

# Clusterinstellingen controleren
curl -X GET "localhost:9200/_cluster/settings?pretty"

Nodebewerkingen

# Alle nodes opzoeken
curl -X GET "localhost:9200/_cat/nodes?v&h=name,node.role,heap.percent,ram.percent,cpu,load_1m"

# Node-statistieken
curl -X GET "localhost:9200/_nodes/stats?pretty"

# Hot threads (probleemoplossing)
curl -X GET "localhost:9200/_nodes/hot_threads"

Indexbeheer

Indexen maken en verwijderen

# Index maken
curl -X PUT "localhost:9200/my_index?pretty"

# Index maken met instellingen
curl -X PUT "localhost:9200/my_index" -H 'Content-Type: application/json' -d'
{
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1
  }
}
'

# Index verwijderen
curl -X DELETE "localhost:9200/my_index?pretty"

# Alle indices opzoeken
curl -X GET "localhost:9200/_cat/indices?v"

# Indexstatistieken
curl -X GET "localhost:9200/my_index/_stats?pretty"

Indexmappings

# Mapping definiëren
curl -X PUT "localhost:9200/products" -H 'Content-Type: application/json' -d'
{
  "mappings": {
    "properties": {
      "name": { "type": "text" },
      "price": { "type": "float" },
      "created_at": { "type": "date" },
      "tags": { "type": "keyword" },
      "description": { 
        "type": "text",
        "analyzer": "english"
      }
    }
  }
}
'

# Mapping ophalen
curl -X GET "localhost:9200/products/_mapping?pretty"

# Mapping bijwerken (veld toevoegen)
curl -X PUT "localhost:9200/products/_mapping" -H 'Content-Type: application/json' -d'
{
  "properties": {
    "category": { "type": "keyword" }
  }
}
'

Indexsjablonen

# Indexsjabloon maken
curl -X PUT "localhost:9200/_index_template/logs_template" -H 'Content-Type: application/json' -d'
{
  "index_patterns": ["logs-*"],
  "template": {
    "settings": {
      "number_of_shards": 1
    },
    "mappings": {
      "properties": {
        "timestamp": { "type": "date" },
        "message": { "type": "text" },
        "level": { "type": "keyword" }
      }
    }
  }
}
'

# Sjablonen opzoeken
curl -X GET "localhost:9200/_index_template?pretty"

Documentbewerkingen (CRUD)

Documenten maken

# Document maken met automatisch gegenereerde ID
curl -X POST "localhost:9200/products/_doc?pretty" -H 'Content-Type: application/json' -d'
{
  "name": "Laptop",
  "price": 999.99,
  "tags": ["electronics", "computers"]
}
'

# Document maken met specifieke ID
curl -X PUT "localhost:9200/products/_doc/1?pretty" -H 'Content-Type: application/json' -d'
{
  "name": "Laptop",
  "price": 999.99
}
'

# Bulk indexing
curl -X POST "localhost:9200/_bulk?pretty" -H 'Content-Type: application/json' -d'
{ "index": { "_index": "products", "_id": "1" }}
{ "name": "Laptop", "price": 999.99 }
{ "index": { "_index": "products", "_id": "2" }}
{ "name": "Mouse", "price": 29.99 }
'

Documenten lezen

# Document opzoeken via ID
curl -X GET "localhost:9200/products/_doc/1?pretty"

# Meerdere documenten opzoeken
curl -X GET "localhost:9200/_mget?pretty" -H 'Content-Type: application/json' -d'
{
  "docs": [
    { "_index": "products", "_id": "1" },
    { "_index": "products", "_id": "2" }
  ]
}
'

# Controleren of een document bestaat
curl -I "localhost:9200/products/_doc/1"

Documenten bijwerken

# Document bijwerken
curl -X POST "localhost:9200/products/_update/1?pretty" -H 'Content-Type: application/json' -d'
{
  "doc": {
    "price": 899.99
  }
}
'

# Bijwerken met script
curl -X POST "localhost:9200/products/_update/1?pretty" -H 'Content-Type: application/json' -d'
{
  "script": {
    "source": "ctx._source.price *= params.discount",
    "params": {
      "discount": 0.9
    }
  }
}
'

# Upsert (bijwerken of invoegen)
curl -X POST "localhost:9200/products/_update/1?pretty" -H 'Content-Type: application/json' -d'
{
  "doc": {
    "price": 899.99
  },
  "doc_as_upsert": true
}
'

Documenten verwijderen

# Verwijderen via ID
curl -X DELETE "localhost:9200/products/_doc/1?pretty"

# Verwijderen via query
curl -X POST "localhost:9200/products/_delete_by_query?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match": {
      "name": "old"
    }
  }
}
'

Zoekopdrachten

Basiszoekopdrachten

# Alles matchen
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match_all": {}
  }
}
'

# Match query
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match": {
      "name": "laptop"
    }
  }
}
'

# Multi-match query
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "multi_match": {
      "query": "laptop gaming",
      "fields": ["name", "description"]
    }
  }
}
'

Termniveau queries

# Term query (exact match)
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "term": {
      "tags": "electronics"
    }
  }
}
'

# Terms query (meerdere waarden)
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "terms": {
      "tags": ["electronics", "computers"]
    }
  }
}
'

# Range query
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "range": {
      "price": {
        "gte": 100,
        "lte": 1000
      }
    }
  }
}
'

# Exists query
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "exists": {
      "field": "description"
    }
  }
}
'

Booleaanse queries

# Booleaanse query (must, should, must_not, filter)
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "bool": {
      "must": [
        { "match": { "name": "laptop" }}
      ],
      "filter": [
        { "range": { "price": { "gte": 500 }}}
      ],
      "should": [
        { "term": { "tags": "gaming" }}
      ],
      "must_not": [
        { "term": { "tags": "refurbished" }}
      ]
    }
  }
}
'

Geavanceerde zoekopdrachten

# Wildcard query
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "wildcard": {
      "name": "lap*"
    }
  }
}
'

# Fuzzy query (typo tolerantie)
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "fuzzy": {
      "name": {
        "value": "laptpo",
        "fuzziness": "AUTO"
      }
    }
  }
}
'

# Prefix query
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "prefix": {
      "name": "lap"
    }
  }
}
'

Aggregaties

Metriek aggregaties

# Gemiddelde, som, minimum, maximum
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "avg_price": { "avg": { "field": "price" }},
    "max_price": { "max": { "field": "price" }},
    "min_price": { "min": { "field": "price" }},
    "total_sales": { "sum": { "field": "price" }}
  }
}
'

# Stats aggregatie
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "price_stats": {
      "stats": { "field": "price" }
    }
  }
}
'

Bucket aggregaties

# Terms aggregatie (groeperen)
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "popular_tags": {
      "terms": {
        "field": "tags",
        "size": 10
      }
    }
  }
}
'

# Range aggregatie
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "price_ranges": {
      "range": {
        "field": "price",
        "ranges": [
          { "to": 50 },
          { "from": 50, "to": 100 },
          { "from": 100 }
        ]
      }
    }
  }
}
'

# Data histogram
curl -X GET "localhost:9200/logs/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "logs_over_time": {
      "date_histogram": {
        "field": "timestamp",
        "calendar_interval": "day"
      }
    }
  }
}
'

Geneste aggregaties

# Geneste aggregaties
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "categories": {
      "terms": { "field": "category" },
      "aggs": {
        "avg_price": {
          "avg": { "field": "price" }
        }
      }
    }
  }
}
'

Sorteren en pagineren

# Sorteren op veld
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": { "match_all": {} },
  "sort": [
    { "price": { "order": "desc" }},
    { "_score": { "order": "desc" }}
  ]
}
'

# Pagineren met from/size
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "from": 0,
  "size": 10,
  "query": { "match_all": {} }
}
'

# Zoeken met search_after (voor diepe pagineren)
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 10,
  "query": { "match_all": {} },
  "sort": [{ "price": "asc" }, { "_id": "asc" }],
  "search_after": [100, "product_123"]
}
'

Veldselectie en benadrukking

# Specifieke velden selecteren
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": { "match_all": {} },
  "_source": ["name", "price"]
}
'

# Benadrukking
curl -X GET "localhost:9200/products/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match": { "description": "gaming laptop" }
  },
  "highlight": {
    "fields": {
      "description": {}
    }
  }
}
'

Indexaliases

# Alias maken
curl -X POST "localhost:9200/_aliases?pretty" -H 'Content-Type: application/json' -d'
{
  "actions": [
    { "add": { "index": "products_v1", "alias": "products" }}
  ]
}
'

# Alias overschakelen naar nieuwe index (zero downtime)
curl -X POST "localhost:9200/_aliases?pretty" -H 'Content-Type: application/json' -d'
{
  "actions": [
    { "remove": { "index": "products_v1", "alias": "products" }},
    { "add": { "index": "products_v2", "alias": "products" }}
  ]
}
'

# Aliases opzoeken
curl -X GET "localhost:9200/_cat/aliases?v"

Reindex

# Reindex van één index naar een andere
curl -X POST "localhost:9200/_reindex?pretty" -H 'Content-Type: application/json' -d'
{
  "source": {
    "index": "old_products"
  },
  "dest": {
    "index": "new_products"
  }
}
'

# Reindex met query
curl -X POST "localhost:9200/_reindex?pretty" -H 'Content-Type: application/json' -d'
{
  "source": {
    "index": "products",
    "query": {
      "range": {
        "price": { "gte": 100 }
      }
    }
  },
  "dest": {
    "index": "expensive_products"
  }
}
'

Back-ups en snapshots

# Snapshotopslag registreren
curl -X PUT "localhost:9200/_snapshot/my_backup?pretty" -H 'Content-Type: application/json' -d'
{
  "type": "fs",
  "settings": {
    "location": "/mount/backups/my_backup"
  }
}
'

# Snapshot maken
curl -X PUT "localhost:9200/_snapshot/my_backup/snapshot_1?wait_for_completion=true&pretty"

# Snapshot herstellen
curl -X POST "localhost:9200/_snapshot/my_backup/snapshot_1/_restore?pretty"

# Snapshots opzoeken
curl -X GET "localhost:9200/_snapshot/my_backup/_all?pretty"

# Snapshot verwijderen
curl -X DELETE "localhost:9200/_snapshot/my_backup/snapshot_1?pretty"

Prestatieoptimalisatie

Indexinstellingen

# Refresh uitschakelen tijdens bulk indexing
curl -X PUT "localhost:9200/products/_settings?pretty" -H 'Content-Type: application/json' -d'
{
  "index": {
    "refresh_interval": "-1"
  }
}
'

# Na bulk indexing weer inschakelen
curl -X PUT "localhost:9200/products/_settings?pretty" -H 'Content-Type: application/json' -d'
{
  "index": {
    "refresh_interval": "1s"
  }
}
'

# Force merge (optimalisatie)
curl -X POST "localhost:9200/products/_forcemerge?max_num_segments=1&pretty"

Cache leegmaken

# Alle caches leegmaken
curl -X POST "localhost:9200/_cache/clear?pretty"

# Specifieke cache leegmaken
curl -X POST "localhost:9200/products/_cache/clear?query=true&pretty"

Monitoring en probleemoplossing

# Wachtrijtaken
curl -X GET "localhost:9200/_cat/pending_tasks?v"

# Thread pool statistieken
curl -X GET "localhost:9200/_cat/thread_pool?v"

# Segmentinformatie
curl -X GET "localhost:9200/_cat/segments?v"

# Herstelinformatie
curl -X GET "localhost:9200/_cat/recovery?v&h=index,stage,time"

# Taken API
curl -X GET "localhost:9200/_tasks?detailed=true&pretty"

Python-clientvoorbeelden

from elasticsearch import Elasticsearch

# Verbinding maken met Elasticsearch
es = Elasticsearch(['http://localhost:9200'])

# Document indexeren
doc = {
    'name': 'Laptop',
    'price': 999.99,
    'tags': ['electronics']
}
es.index(index='products', id=1, document=doc)

# Zoeken
resp = es.search(index='products', query={'match': {'name': 'laptop'}})
for hit in resp['hits']['hits']:
    print(hit['_source'])

# Bulk indexing
from elasticsearch.helpers import bulk

actions = [
    {
        '_index': 'products',
        '_id': i,
        '_source': {'name': f'Product {i}', 'price': i * 10}
    }
    for i in range(1000)
]
bulk(es, actions)

JavaScript/Node.js-clientvoorbeelden

De Elasticsearch JavaScript-client biedt een typesafe manier om met je cluster te communiceren. Voor productieapplicaties, overweeg het gebruik van TypeScript voor betere typesafety en autocompletion. Zie onze TypeScript Cheat Sheet voor best practices over type definities en interfaces.

const { Client } = require('@elastic/elasticsearch');
const client = new Client({ node: 'http://localhost:9200' });

// Document indexeren
async function indexDoc() {
  await client.index({
    index: 'products',
    id: 1,
    document: {
      name: 'Laptop',
      price: 999.99
    }
  });
}

// Zoeken
async function search() {
  const result = await client.search({
    index: 'products',
    query: {
      match: { name: 'laptop' }
    }
  });
  console.log(result.hits.hits);
}

// Bulk indexing
async function bulkIndex() {
  const operations = [];
  for (let i = 0; i < 1000; i++) {
    operations.push({ index: { _index: 'products', _id: i } });
    operations.push({ name: `Product ${i}`, price: i * 10 });
  }
  await client.bulk({ operations });
}

TypeScriptvoorbeeld met sterke typen

import { Client } from '@elastic/elasticsearch';

interface Product {
  name: string;
  price: number;
  tags?: string[];
  created_at?: Date;
}

const client = new Client({ node: 'http://localhost:9200' });

async function indexProduct(product: Product, id: number): Promise<void> {
  await client.index<Product>({
    index: 'products',
    id: id.toString(),
    document: product
  });
}

async function searchProducts(query: string): Promise<Product[]> {
  const result = await client.search<Product>({
    index: 'products',
    query: {
      match: { name: query }
    }
  });
  
  return result.hits.hits.map(hit => hit._source as Product);
}

Best practices

Indexontwerp

  • Houd schijfgrootte tussen 20-50 GB voor optimale prestaties
  • Gebruik indexlevenscyclusbeheer (ILM) voor tijdreeksgegevens
  • Ontwerp mappings zorgvuldig voorafgaand aan het indexeren van gegevens
  • Gebruik geschikte veldtypen (keyword vs text, datumformaten)
  • Schakel _source uit voor grote documenten als het niet nodig is

Queryoptimalisatie

  • Gebruik filters in plaats van queries wanneer geen score nodig is
  • Voorkeur geven aan termniveau queries voor gestructureerde data
  • Gebruik bool query om meerdere voorwaarden efficiënt te combineren
  • Implementeer pagineren met search_after voor diepe pagineren
  • Cache vaak gebruikte filters

Indexering prestaties

  • Gebruik bulk API voor batch indexering (1000-5000 documenten per aanvraag)
  • Schakel refresh uit tijdens bulkbewerkingen
  • Verhoog index.refresh_interval tijdens zware indexering
  • Gebruik meerdere threads/werkers voor parallelle indexering
  • Overweeg het gebruik van routing voor betere schijfdistributie

Clusterbeheer

  • Monitor clusterstatus regelmatig
  • Stel juiste replicaconfiguratie in
  • Gebruik toegewezen masterknooppunten voor grote clusters
  • Implementeer juiste back-upstrategie met snapshots
  • Monitor JVM heapgebruik (houd onder de 75%)

Beveiliging

  • Schakel authenticatie en autorisatie in (X-Pack Security)
  • Gebruik HTTPS voor productiedeployments (stel cURL in met --cacert, --cert en --key opties voor SSL/TLS)
  • Implementeer juiste rolgebaseerde toegangscontrole
  • Regelmatige beveiligingsupdates en patches
  • Versleutel gegevens op de schijf en tijdens overdracht

Algemene gebruiksscenario’s

Volledige tekstzoekopdrachten

Elasticsearch is uitstekend in volledige tekstzoekopdrachten met functies zoals:

  • Relevante score
  • Vagere matching
  • Frazematching
  • Synoniembehandeling
  • Ondersteuning voor meertaligheid

Loganalyse (ELK Stack)

  • Verzamel logs met Logstash/Filebeat
  • Index en zoek logs in Elasticsearch
  • Visualiseer met Kibana dashboards
  • Stel waarschuwingen in voor afwijkingen

E-commerce zoekopdrachten

  • Productcataloguszoekopdrachten
  • Faceted navigatie met aggregaties
  • Automatisch invullen en suggesties
  • Persoonlijke zoekresultaten

Toepassingsprestatie monitoring

  • Index toepassingsmetrieken
  • Real-time monitoring dashboards
  • Afwijkingdetectie
  • Trendanalyse van prestaties

Officiële Elasticsearch bronnen

Gerelateerde cheat sheets en gidsen