如何在elasticsearch中正确编写布尔值或逻辑？

一尘不染

如何在elasticsearch中正确编写布尔值或逻辑？

elasticsearch

我想使用loId=6 AND (actionType = "SAVE_DATA" OR 获取所有文档actionType = "OPEN_SCREEN")。

我写错了这个逻辑吗？

为什么我的查询返回0个结果？

注意：我可以接受查询或过滤器来解决此问题。

这些是一些示例文档：

 {
    "_index": "logs",
    "_type": "record",
    "_id": "eIIt3vtrSxmdOVGClQmN3w",
    "_score": 1,
    "_source": {
       "timestamp": 1373569919000,
       "uid": 6,
       "paId": 56298,
       "loId": 6,
       "prId": 2,
       "vId": 6577,
       "actionType": "SAVE_DATA"
    }
 },
 {
    "_index": "logs",
    "_type": "record",
    "_id": "yQGCia6qRYCImZLyH7DrEA",
    "_score": 1,
    "_source": {
       "timestamp": 1373570314000,
       "uid": 6,
       "paId": 56641,
       "loId": 6,
       "prId": 2,
       "vId": 6578,
       "actionType": "CHECK_IN"
    }
 },
 {
    "_index": "logs",
    "_type": "record",
    "_id": "2raajrNKTKeRKG88wiNPpw",
    "_score": 1,
    "_source": {
       "timestamp": 1373570532000,
       "uid": 6,
       "paId": 56641,
       "loId": 6,
       "prId": 2,
       "vId": 6579,
       "actionType": "LOAD_DATA"
    }
 },
 {
    "_index": "logs",
    "_type": "record",
    "_id": "0FDBxW2ESl6tfmj81YJvIg",
    "_score": 1,
    "_source": {
       "timestamp": 1373570761000,
       "uid": 6,
       "paId": 56298,
       "loId": 6,
       "prId": 2,
       "vId": 6577,
       "actionType": "OPEN_SCREEN"
    }
 },
 {
    "_index": "logs",
    "_type": "record",
    "_id": "-bFQyEdCQVWiXNldtxz04g",
    "_score": 1,
    "_source": {
       "timestamp": 1373570777000,
       "uid": 6,
       "paId": 56298,
       "loId": 6,
       "prId": 2,
       "vId": 6577,
       "actionType": "OPEN_SCREEN"
    }
 }

询问

{
   "query": {
      "filtered": {
          "query": {
              "term": {
                    "loId": 6
              }
          }, 
         "filter": {
            "or": {
               "filters": [
                  {
                     "term": {
                        "actionType": "SAVE_DATA"
                     }
                  },
                  {
                     "term": {
                        "actionType": "OPEN_SCREEN"
                     }
                  }
               ],
               "_cache": false
            }
         }
      }
   }
}

阅读 222

2020-06-22

共1个答案

一尘不染

您无法获得结果的主要原因是因为您试图对进行term过滤actionType，这是一个已分析的字段。如果要term对该字段进行匹配，则需要更新类型映射以将该字段设置为not_analyzed。请参见以下示例映射：

{
   "record": {
      "properties": {
         "actionType": {
            "type": "string",
            "index": "not_analyzed",
         },
         "loId": {
            "type": "long"
         },
         "paId": {
            "type": "long"
         },
         "prId": {
            "type": "long"
         },
         "timestamp": {
            "type": "long"
         },
         "uid": {
            "type": "long"
         },
         "vId": {
            "type": "long"
         }
      }
   }
}

从此处开始阅读有关映射的信息：http :
//www.elasticsearch.org/guide/reference/mapping/。您需要重新索引数据。修复该问题后，下面的查询将起作用：

{ 
    "query": { 
        "filtered": {
           "query": {"match_all":{}},
           "filter": {
               "bool": {
                   "must": [
                       {"term": {"loId":6}},
                       {
                           "or": [
                               {"term":{"actionType": "SAVE_DATA"}},
                               {"term":{"actionType": "OPEN_SCREEN"}}
                           ]
                       }
                   ]
               }
           }
        }
    }
}

2020-06-22