我不明白为什么如果我查询Elasticsearch与过滤器像这样:
curl -H'content-type: application/json' "localhost:9200/.kibana/_search" -d '{
"query": {
"bool": {
"filter": [
{
"term": {
"type": "index-pattern"
}
}
]
}
}
}'
{"took":0,"timed_out":false,"_shards":{"total":4,"successful":4,"skipped":0,"failed":0},"hits":{"total":{"value":0,"relation":"eq"},"max_score":null,"hits":[]}}
正如你所看到的,我有一个空的结果集,但是我有一个文档,其中“type”字段等于“index-pattern”。
{
"_index": ".kibana",
"_type": "_doc",
"_id": "index-pattern:c37de740-7e94-11eb-b6c2-4302716621be",
"_score": 0,
"_source": {
"index-pattern": {
"title": "r*",
"timeFieldName": "@timestamp",
"fields": "<omitted - too long>"
},
"type": "index-pattern",
"references": [],
"migrationVersion": {
"index-pattern": "7.6.0"
},
"updated_at": "2021-03-06T15:58:18.062Z"
}
}
我的问题出了什么问题?
1条答案
按热度按时间mbzjlibv1#
当
type
字段默认Map为text
,而您希望对其应用term
查询时,连字符将阻止查询匹配,因为text
是由标准分析器分析的,它会在接收时删除连字符和其他特殊字符。term
query返回包含精确匹配(包括特殊字符)的文档,该匹配导致原始查询不返回任何内容。因此,改为以
.keyword
multi-field为目标: