ElasticSearch未找到包含查询的文档的匹配项

carvr3hs  于 2023-01-29  发布在  ElasticSearch
关注(0)|答案(1)|浏览(169)

我正在尝试搜索一个索引,查找包含“信号量”和“RabbitMQ.Client.Impl”的异常字段的文档。
例外示例:

System.ObjectDisposedException: The semaphore has been disposed.
   at System.Threading.SemaphoreSlim.Release(Int32 releaseCount)
   at RabbitMQ.Client.Impl.AsyncConsumerWorkService.WorkPool.HandleConcurrent(Work work, IModel model, SemaphoreSlim limiter)

当我搜索“信号量”时-文档被返回-太棒了!

POST /logs-2023-01/_search?pretty=true
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "exception": "semaphore"
          }
        },

        {
          "range": {
            "logDate": {
              "gte": "now-43200m"
            }
          }
        }
      ]
    }
  },

  "size": 1000
}

上述查询返回:

{
  "took": 5,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 1,
    "max_score": 7.5582323,
    "hits": [
      {
        "_index": "logs-2023-01",
        "_type": "record",
        "_id": "q21yk4UBAdlSjmEEw5gy",
        "_score": 7.5582323,
        "_source": {
          "applicationName": "k8s-application",
          "logDate": "2023-01-08T22:13:59.873",
          "logLevel": "Error",
          "loggerName": "TaskScheduler.UnobservedTaskException.Logger",
          "machineName": "k8s-pod-6755d4997c-rztgl",
          "threadId": "2",
          "message": "An unobserved task exception occurred. The semaphore has been disposed.",
          "exception": """
System.ObjectDisposedException: The semaphore has been disposed.
   at System.Threading.SemaphoreSlim.Release(Int32 releaseCount)
   at RabbitMQ.Client.Impl.AsyncConsumerWorkService.WorkPool.HandleConcurrent(Work work, IModel model, SemaphoreSlim limiter)

""",
          "sortDate": "2023-01-08T22:13:59.000027026"
        }
      }
    ]
  }
}

然而,当我对查询“RabbitMQ.Client.Impl”(100%包含在异常中)进行相同的搜索时,我什么也没得到,为什么?

POST /logs-2023-01/_search?pretty=true
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "exception": "RabbitMQ.Client.Impl"
          }
        },

        {
          "range": {
            "logDate": {
              "gte": "now-43200m"
            }
          }
        }
      ]
    }
  },

  "size": 1000
}

上述查询返回:

{
  "took": 8,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  }
}
klsxnrf1

klsxnrf11#

尾巴;

match查询将查找确切的标记。

溶液

令牌由分析器在接收时生成。默认的分析器在空白处拆分令牌。
这意味着rabbitmq.client.impl.asyncconsumerworkservice.workpool.handleconcurrent将是一个令牌。
它不会匹配RabbitMQ.Client.Impl
但是您可以使用match_phrase_prefix
使用以下查询:

GET 75236255/_search
{
  "query": {
    "match_phrase_prefix": {
      "exception": "RabbitMQ.Client.Impl"
    }
  }
}

相关问题