Elasticsearch 5.x Cookbook - Third Edition

Book Image

Elasticsearch 5.x Cookbook - Third Edition

By : Alberto Paro

Book Image

Elasticsearch 5.x Cookbook - Third Edition

By: Alberto Paro

Overview of this book

Elasticsearch is a Lucene-based distributed search server that allows users to index and search unstructured content with petabytes of data. This book is your one-stop guide to master the complete Elasticsearch ecosystem. We’ll guide you through comprehensive recipes on what’s new in Elasticsearch 5.x, showing you how to create complex queries and analytics, and perform index mapping, aggregation, and scripting. Further on, you will explore the modules of Cluster and Node monitoring and see ways to back up and restore a snapshot of an index. You will understand how to install Kibana to monitor a cluster and also to extend Kibana for plugins. Finally, you will also see how you can integrate your Java, Scala, Python, and Big Data applications such as Apache Spark and Pig with Elasticsearch, and add enhanced functionalities with custom plugins. By the end of this book, you will have an in-depth knowledge of the implementation of the Elasticsearch architecture and will be able to manage data efficiently and effectively with Elasticsearch.

Credits

About the Author

About the Author

About the Reviewer

About the Reviewer

www.PacktPub.com

www.PacktPub.com

Customer Feedback

Customer Feedback

Dedication

Preface

Free Chapter

Getting Started

Getting Started

Understanding node and cluster

Understanding node services

Managing your data

Understanding cluster, replication, and sharding

Communicating with Elasticsearch

Using the HTTP protocol

Using the native protocol

Downloading and Setup

Downloading and Setup

Downloading and installing Elasticsearch

Setting up networking

Setting up a node

Setting up for Linux systems

Setting up different node types

Setting up a client node

Setting up an ingestion node

Installing plugins in Elasticsearch

Installing plugins manually

Removing a plugin

Changing logging settings

Setting up a node via Docker

Managing Mappings

Managing Mappings

Using explicit mapping creation

Mapping base types

Mapping an object

Mapping a document

Using dynamic templates in document mapping

Managing nested objects

Managing child document

Adding a field with multiple mapping

Mapping a GeoPoint field

Mapping a GeoShape field

Mapping an IP field

Mapping an attachment field

Adding metadata to a mapping

Specifying a different analyzer

Mapping a completion field

Basic Operations

Basic Operations

Creating an index

Deleting an index

Opening/closing an index

Putting a mapping in an index

Getting a mapping

Reindexing an index

Refreshing an index

Flushing an index

ForceMerge an index

Shrinking an index

Checking if an index or type exists

Managing index settings

Using index aliases

Rollover an index

Indexing a document

Getting a document

Deleting a document

Updating a document

Speeding up atomic operations (bulk operations)

Speeding up GET operations (multi GET)

Search

Executing a search

Sorting results

Highlighting results

Executing a scrolling query

Using the search_after functionality

Returning inner hits in results

Suggesting a correct query

Counting matched results

Explaining a query

Query profiling

Deleting by query

Updating by query

Matching all the documents

Using a boolean query

Text and Numeric Queries

Text and Numeric Queries

Using a term query

Using a terms query

Using a prefix query

Using a wildcard query

Using a regexp query

Using span queries

Using a match query

Using a query string query

Using a simple query string query

Using the range query

The common terms query

Using IDs query

Using the function score query

Using the exists query

Using the template query

Relationships and Geo Queries

Relationships and Geo Queries

Using the has_child query

Using the has_parent query

Using nested queries

Using the geo_bounding_box query

Using the geo_polygon query

Using the geo_distance query

Using the geo_distance_range query

Aggregations

Executing an aggregation

Executing stats aggregations

Executing terms aggregation

Executing significant terms aggregation

Executing range aggregations

Executing histogram aggregations

Executing date histogram aggregations

Executing filter aggregations

Executing filters aggregations

Executing global aggregations

Executing geo distance aggregations

Executing children aggregations

Executing nested aggregations

Executing top hit aggregations

Executing a matrix stats aggregation

Executing geo bounds aggregations

Executing geo centroid aggregations

Scripting

Painless scripting

Installing additional script plugins

Managing scripts

Sorting data using scripts

Computing return fields with scripting

Filtering a search via scripting

Using scripting in aggregations

Updating a document using scripts

Reindexing with a script

Managing Clusters and Nodes

Managing Clusters and Nodes

Controlling cluster health via an API

Controlling cluster state via an API

Getting nodes information via API

Getting node statistics via the API

Using the task management API

Managing the shard allocation

Monitoring segments with the segment API

Cleaning the cache

Backup and Restore

Backup and Restore

Managing repositories

Executing a snapshot

Restoring a snapshot

Setting up a NFS share for backup

Reindexing from a remote cluster

User Interfaces

User Interfaces

Installing and using Cerebro

Installing Kibana and X-Pack

Managing Kibana dashboards

Monitoring with Kibana

Using Kibana dev-console

Visualizing data with Kibana

Installing Kibana plugins

Generating graph with Kibana

Ingest

Pipeline definition

Put an ingest pipeline

Get an ingest pipeline

Delete an ingest pipeline

Simulate an ingest pipeline

Built-in processors

Using the ingest attachment plugin

Using the ingest GeoIP plugin

Java Integration

Java Integration

Creating a standard Java HTTP client

Creating an HTTP Elasticsearch client

Creating a native client

Managing indices with the native client

Managing mappings

Managing documents

Managing bulk actions

Building a query

Executing a standard search

Executing a search with aggregations

Executing a scroll search

Scala Integration

Scala Integration

Creating a client in Scala

Managing indices

Managing mappings

Managing documents

Executing a standard search

Executing a search with aggregations

Python Integration

Python Integration

Creating a client

Managing indices

Managing mappings include the mapping

Managing documents

Executing a standard search

Executing a search with aggregations

Plugin Development

Plugin Development

Creating a plugin

Creating an analyzer plugin

Creating a REST plugin

Creating a cluster action

Creating an ingest plugin

Big Data Integration

Big Data Integration

Installing Apache Spark

Indexing data via Apache Spark

Indexing data with meta via Apache Spark

Reading data with Apache Spark

Reading data using SparkSQL

Indexing data with Apache Pig

Customer Reviews

5 star

0

4 star

0

3 star

0

2 star

0

1 star

0

Grok processor

Elasticsearch provides a large number of built-in processors that increases with every release. In the preceding examples, we have seen the set and the replace ones. In this recipe, we will cover one of the most used for log analysis: the grok processor, which is well known to Logstash users.

Getting ready

You need an up-and-running Elasticsearch installation, as we described in the Downloading and installing Elasticsearch recipe in Chapter 2, Downloading and Setup.

To execute curl via the command line, you need to install curl for your operative system.

How to do it...

To test a grok pattern against some log lines, we will perform the following steps:

We will execute a call passing both the pipeline with our grok processor and a sample subset of a document to test the pipeline against:

        curl -XPOST 'http://127.0.0.1:9200/_ingest/pipeline/_simulate?
        pretty' -d '{
          "pipeline": {
            "description": "Testing grok pattern",
            "processors": [...