Crash Course of Elasticsearch in 10 mins

What is Elasticsearch?
Elasticsearch is fast, horizontally scalable open source search engine. It provides HTTP API for storing and indexing JSON documents and with default configuration it behaves a little bit like searchable NoSQL database.

Installation – RHEL/Centos

$ sudo yum install wget -y
wget --no-cookies --no-check-certificate --header "Cookie: gpw_e24=http%3A%2F%2Fwww.oracle.com%2F; oraclelicense=accept-securebackup-cookie" "http://download.oracle.com/otn-pub/java/jdk/8u181-b13/96a7b8442fe848ef90c96a2fad6ed6d1/jdk-8u181-linux-x64.tar.gz"
tar -zxvf jdk-8u181-linux-x64.tar.gz
sudo mv jdk1.8.0_181 /opt/
export JAVA_HOME=/opt/jdk1.8.0_181
export PATH=$PATH:$JAVA_HOME/bin
java -version
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-oss-6.4.0.zip
sudo yum install unzip -y
unzip elasticsearch-oss-6.4.0.zip
cd elasticsearch-oss-6.4.0
./bin/elasticsearch -Ecluster.name=devopsschool -Enode.name=my_first_node
curl http://localhost:9200

Check node’s health status:
$ curl 127.0.0.1:9200/_cat/health?v

Get list of current indices
$ curl 127.00.1:9200/_cat/indices?v

Understanding Elasticsearch Keywords and Terminology

Understanding Elasticsearch Keywords and Terminology

CRUD Operations using RESTful API of Elasticsearch using Create, Read, Update, Delete


Create - Adding new document to elasticsearch is as easy as HTTP POST request:
$ curl -X POST 127.0.0.1:9200/monitor/logs?pretty -d '{
"kind": "info",
"message": "The server is up and running"
}'
#{
# "_index" : "monitor",
# "_type" : "logs",
# "_id" : "AVoWblBE6fU5oFCNC7jY",
# "_version" : 1,
# "result" : "created",
# "_shards" : {
# "total" : 2,
# "successful" : 1,
# "failed" : 0
# },
# "created" : true
#}

As not many people would actually enjoy inserting documents one by one, there’s also bulk insert option.

$ curl -X POST 127.0.0.1:9200/monitor/logs/_bulk -d '
{ "index": {}}
{ "kind" : "warn", "message": "Using 90% of memory" }
{ "index": {}}
{ "kind": "err", "message": "OutOfMemoryException: Epic fail has just happened" }
'

Read - when we have something in the index, we can perform simple search to read the documents back.

curl 127.0.0.1:9200/monitor/_search?pretty
#{
# .........
# "hits" : {
# "total" : 3,
# "max_score" : 1.0,
# "hits" : [
# {
# "_index" : "monitor",
# "_type" : "logs",
# "_id" : "AVoWe_7d6fU5oFCNC7jb",
# "_score" : 1.0,
# "_source" : {
# "kind" : "err",
# "message" : "OutOfMemoryException: Epic fail has just happened"
# }
# },
# {
# "_index" : "monitor",
# "_type" : "logs",
# "_id" : "AVoWe_7d6fU5oFCNC7ja",
# "_score" : 1.0,
# "_source" : {
# "kind" : "warn",
# "message" : "Using 90% of memory"
# }
# },
# {
# "_index" : "monitor",
# "_type" : "logs",
# "_id" : "AVoWblBE6fU5oFCNC7jY",
# "_score" : 1.0,
# "_source" : {
# "kind" : "info",
# "message" : "The server is up and running"
# }
# }
# ]
# }
#}

It’s also possible to get single document by its ID:

curl 127.0.0.1:9200/monitor/logs/AVoWblBE6fU5oFCNC7jY?pretty
#{
# ...
# "_source" : {
# "kind" : "info",
# "message" : "The server is up and running"
# }
#}

Update - Similarly, knowing document ID we can update it.

$ curl -X POST 127.0.0.1:9200/monitor/logs/AVoWe_7d6fU5oFCNC7jb -d '
{ "kind": "err",
"message": "OutOfMemoryException: The server process used all available memory"
}'

Delete - When you need to get rid of something, HTTP DELETE will do the trick. E.g.
$ curl -X DELETE 127.0.0.1:9200/monitor/logs/AVoWe_7d6fU5oFCNC7jb

Search - The real power of elasticsearch is in search (duh). There’re two approaches for searching for data: the REST Request API for simple queries and more sophisticated Query DSL.

$ curl -s 127.0.0.1:9200/monitor/_search?q=memory | json_pp
$ curl -s 127.0.0.1:9200/monitor/_search -d '