Elasticsearch筛选查询不返回任何文档

d8tt03nd  于 2023-02-07  发布在  ElasticSearch
关注(0)|答案(1)|浏览(153)

我不明白为什么如果我查询Elasticsearch与过滤器像这样:

curl -H'content-type: application/json' "localhost:9200/.kibana/_search" -d '{
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "type": "index-pattern"
          }
        }
      ]
    }
  }
}'
{"took":0,"timed_out":false,"_shards":{"total":4,"successful":4,"skipped":0,"failed":0},"hits":{"total":{"value":0,"relation":"eq"},"max_score":null,"hits":[]}}

正如你所看到的,我有一个空的结果集,但是我有一个文档,其中“type”字段等于“index-pattern”。

{
    "_index": ".kibana",
    "_type": "_doc",
    "_id": "index-pattern:c37de740-7e94-11eb-b6c2-4302716621be",
    "_score": 0,
    "_source": {
      "index-pattern": {
        "title": "r*",
        "timeFieldName": "@timestamp",
        "fields": "<omitted - too long>"
      },
      "type": "index-pattern",
      "references": [],
      "migrationVersion": {
        "index-pattern": "7.6.0"
      },
      "updated_at": "2021-03-06T15:58:18.062Z"
    }
  }

我的问题出了什么问题?

mbzjlibv

mbzjlibv1#

type字段默认Map为text,而您希望对其应用term查询时,连字符将阻止查询匹配,因为text是由标准分析器分析的,它会在接收时删除连字符和其他特殊字符。term query返回包含精确匹配(包括特殊字符)的文档,该匹配导致原始查询不返回任何内容。
因此,改为以.keywordmulti-field为目标:

curl -H'content-type: application/json' "localhost:9200/.kibana/_search" -d '{
  "query": {
    "bool": {
      "filter": [
        {
          "term.keyword": {
            "type": "index-pattern"
          }
        }
      ]
    }
  }
}'

相关问题