Elasticsearch 8.x 完全指南 2026：倒排索引 + 向量检索 (Vector/RAG) + 聚合分析 + Python 实战

1
文档集合：
2
Doc 1: "Elasticsearch 架构 设计"
3
Doc 2: "Kafka 架构 原理"
4
Doc 3: "Elasticsearch 向量 检索"
5

6
构建倒排索引：
7
┌─────────────────┬───────────┬───────────────────────────────┐
8
│ Term (词项)     │ DF (文档频次)│ Posting List (倒排列表)        │
9
├─────────────────┼───────────┼───────────────────────────────┤
10
│ Elasticsearch   │     2     │ [Doc1: {pos:0}], [Doc3: {pos:0}]│
11
│ 架构            │     2     │ [Doc1: {pos:1}], [Doc2: {pos:1}]│
12
│ 设计            │     1     │ [Doc1: {pos:2}]               │
13
│ Kafka           │     1     │ [Doc2: {pos:0}]               │
14
│ 原理            │     1     │ [Doc2: {pos:2}]               │
15
│ 向量            │     1     │ [Doc3: {pos:1}]               │
16
│ 检索            │     1     │ [Doc3: {pos:2}]               │
17
└─────────────────┴───────────┴───────────────────────────────┘

1
// 测试 IK 分词器效果
2
POST /_analyze
3
{
4
  "analyzer": "ik_max_word",
5
  "text": "分布式向量搜索引擎 Elasticsearch"
6
}

1
PUT /articles
2
{
3
  "settings": {
4
    "number_of_shards": 3,
5
    "number_of_replicas": 1,
6
    "analysis": {
7
      "analyzer": {
8
        "ik_pinyin_analyzer": {
9
          "type": "custom",
10
          "tokenizer": "ik_max_word",
11
          "filter": ["my_pinyin_filter", "lowercase"]
12
        }
13
      },
14
      "filter": {
15
        "my_pinyin_filter": {
16
          "type": "pinyin",
17
          "keep_first_letter": true,
18
          "keep_full_pinyin": true,
19
          "keep_original": true
20
        }
21
      }
22
    }
23
  },
24
  "mappings": {
25
    "properties": {
26
      "id": { "type": "keyword" },
27
      "title": {
28
        "type": "text",
29
        "analyzer": "ik_max_word",
30
        "search_analyzer": "ik_smart",
31
        "fields": {
32
          "keyword": { "type": "keyword", "ignore_above": 256 },
33
          "pinyin": { "type": "text", "analyzer": "ik_pinyin_analyzer" }
34
        }
35
      },
36
      "content": {
37
        "type": "text",
38
        "analyzer": "ik_max_word",
39
        "search_analyzer": "ik_smart"
40
      },
41
      "category": { "type": "keyword" },
42
      "views": { "type": "integer" },
43
      "published_at": { "type": "date" },
44
      // 2026 核心：密集向量字段（用于 RAG 文本嵌入）
45
      "content_vector": {
46
        "type": "dense_vector",
47
        "dims": 1536,                 // 如 OpenAI text-embedding-3-small 维度
48
        "index": true,
49
        "similarity": "cosine"         // 余弦相似度 (cosine / l2_norm / dot_product)
50
      }
51
    }
52
  }
53
}

1
POST /articles/_search
2
{
3
  "query": {
4
    "bool": {
5
      // 必须匹配（计算相关性得分 _score）
6
      "must": [
7
        {
8
          "multi_match": {
9
            "query": "Kafka 与 Redis 架构对比",
10
            "fields": ["title^3", "content"], // title 权重乘 3
11
            "type": "best_fields"
12
          }
13
        }
14
      ],
15
      // 必须不匹配
16
      "must_not": [
17
        { "term": { "status": "draft" } }
18
      ],
19
      // 过滤条件（不计算得分，自动被 Node Query Cache 缓存，极快）
20
      "filter": [
21
        { "term": { "category": "技术文档" } },
22
        { "range": { "published_at": { "gte": "2026-01-01" } } },
23
        { "range": { "views": { "gte": 100 } } }
24
      ]
25
    }
26
  },
27
  "highlight": {
28
    "fields": {
29
      "title": { "pre_tags": ["<mark>"], "post_tags": ["</mark>"] },
30
      "content": { "fragment_size": 150, "number_of_fragments": 2 }
31
    }
32
  },
33
  "from": 0,
34
  "size": 10,
35
  "sort": [
36
    { "_score": { "order": "desc" } },
37
    { "published_at": { "order": "desc" } }
38
  ]
39
}

1
POST /articles/_search
2
{
3
  "size": 0, // 不需要具体文档明细，仅需聚合结果
4
  "aggs": {
5
    // 按分类分桶 (Bucket 聚合)
6
    "categories_agg": {
7
      "terms": {
8
        "field": "category",
9
        "size": 10
10
      },
11
      "aggs": {
12
        // 每个分类下的平均浏览量 (Metrics 聚合)
13
        "avg_views": {
14
          "avg": { "field": "views" }
15
        },
16
        // 每个分类下按月发布直方图
17
        "monthly_histogram": {
18
          "date_histogram": {
19
            "field": "published_at",
20
            "calendar_interval": "month"
21
          }
22
        }
23
      }
24
    }
25
  }
26
}

1
POST /articles/_search
2
{
3
  // 1. 传统 BM25 关键字检索
4
  "query": {
5
    "match": {
6
      "content": "分布式高可用配置实战"
7
    }
8
  },
9
  // 2. 向量 kNN 检索
10
  "knn": {
11
    "field": "content_vector",
12
    "query_vector": [0.012, -0.045, 0.088, ..., 0.031], // 1536 维向量
13
    "k": 20,
14
    "num_candidates": 100,
15
    // 向量检索也可附加硬过滤条件
16
    "filter": {
17
      "term": { "category": "技术文档" }
18
    }
19
  },
20
  // 3. RRF 倒数排名融合算法
21
  "rank": {
22
    "rrf": {
23
      "window_size": 50, // 参与排名的候选窗口大小
24
      "rank_constant": 60 // 默认平滑常量 (k=60)
25
    }
26
  },
27
  "size": 5
28
}

1
数据生命周期流转：
2
[Hot 阶段] ──(7天后)──▶ [Warm 阶段] ──(30天后)──▶ [Cold 阶段] ──(90天后)──▶ [Delete 阶段]
3
(高性能 NVMe SSD)      (普通 SSD / 缩小副本)    (低成本 HDD / 只读)    (彻底删除释放空间)

1
// 配置 ILM 策略
2
PUT /_ilm/policy/logs_lifecycle_policy
3
{
4
  "policy": {
5
    "phases": {
6
      "hot": {
7
        "actions": {
8
          "rollover": {
9
            "max_primary_shard_size": "50GB",
10
            "max_age": "7d"
11
          }
12
        }
13
      },
14
      "warm": {
15
        "min_age": "7d",
16
        "actions": {
17
          "forcemerge": { "max_num_segments": 1 },
18
          "allocate": { "number_of_replicas": 1 }
19
        }
20
      },
21
      "cold": {
22
        "min_age": "30d",
23
        "actions": {
24
          "allocate": { "number_of_replicas": 0 }
25
        }
26
      },
27
      "delete": {
28
        "min_age": "90d",
29
        "actions": { "delete": {} }
30
      }
31
    }
32
  }
33
}