首先我想展示一下文件的简化结构。
{
"_id": "413123123",
"_source": {
"description": {
"firstLine": "this is my description",
"secondLine": "some value"
},
"InsertDetails": {
"Timestamp": "2020-06-12T11:14:36+0000"
},
"Links": [
{
"LinkDetails": {
"linkId": 2342,
"type": "Link",
"dateCreation": "2012-09-21T08:42:09+0000",
"typeId": 404019,
"typeOfLink": "http"
}
},
{
"LinkDetails": {
"linkId": 321313,
"type": "Link",
"dateCreation": "2012-08-21T08:42:09+0000",
"typeId": 404019,
"typeOfLink": "http"
}
},
{
"LinkDetails": {
"linkId": 1231,
"type": "Link",
"dateCreation": "2012-09-21T08:42:09+0000",
"typeId": 32323,
"typeOfLink": "https"
}
},
{
"LinkDetails": {
"linkId": 53434,
"type": "Link",
"dateCreation": "2012-11-21T08:42:09+0000",
"typeId": 123231,
"typeOfLink": "wss"
}
}
]
}
}
我在形成查询时遇到问题,该查询将查找满足以下要求的文档:
链接数组中的两个项的typeoflink等于http
描述字符串包含单词“this”
找到的项目将按日期说明排序
elasticsearch的版本是2.3.2
我尝试过这样的查询:
{
"query": {
"bool": {
"must": [
{
"bool": {
"must": [
{
"match": {
"Links.LinkDetails.typeOfLink": "http"
}
}
],
"minimum_should_match": 2
}
},
{
"match": {
"description.firstLine": "this"
}
}
]
}
},
"sort": [
{
"InsertDetails.Timestamp": {
"order": "desc"
}
}
]
}
问题是这个查询还返回文档,在数组中只有一项具有给定值。我尝试过用不同的方式修改这个查询,但是没有任何运气。
添加的Map
{
"my_index": {
"mappings": {
"en": {
"properties": {
"InsertDetails": {
"properties": {
"Timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
}
}
},
"description": {
"properties": {
"firstLine": {
"type": "string"
},
"secondLine": {
"type": "string"
}
}
},
"Links": {
"properties": {
"LinkDetails": {
"properties": {
"linkId": {
"type": "long"
},
"type": {
"type": "string"
},
"dateCreation": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"typeOfLink": {
"type": "string"
},
"typeId": {
"type": "long"
}
}
}
}
}
}
}
}
}
}
1条答案
按热度按时间wbgh16ku1#
首先,要对嵌套字段进行筛选(对象数组)要获得一致的结果,必须将此字段Map为嵌套字段。https://www.elastic.co/guide/en/elasticsearch/reference/current/nested.html
然后,您将不得不使用聚合。您想要的是只聚合类型为\u的\u链接的“http”值,如果聚合返回2个以上的结果,则返回结果。
您的查询将更加复杂:
你的回答是:
通过使用给定的聚合,您应该能够做您想做的事情。