Elasticsearch 可搜索合成字段 [英] Elasticsearch searchable synthetic fields

问题描述

假设在源文档 (JSON) 中存在几个名为 a 和 b 的字段，long 类型，我想构建一个合成字段(例如 c)通过用下划线连接前面的字段的值和将其索引为 keyword.

Provided that in a source document (JSON) exist a couple of fields named, a and b, that are of type long, I would like to construct a synthetic field (e.g. c) by concatenating the values of the previous fields with an underscore and index it as keyword.

也就是说，我正在研究一种可以通过像这样的虚构的部分映射来支持的功能:

That is, I am looking into a feature that could be supported with an imaginary, partial, mapping like this:

...

  "a": { "type": "long" },
  "b": { "type": "long" },
  "c": {
    "type": "keyword"
    "expression": "${a}_${b}" 
  },
...

注意: 上面的映射只是为了示例而制作的.无效！

NOTE: The mapping above was made up just for the sake of the example. It is NOT valid!

所以我正在寻找的是，elasticsearch 中是否有一个功能，支持的配方或提示这个要求.该字段不需要在_source中注册，只需可搜索即可.

So what I am looking for, is if there is a feature in elasticsearch, a recipe or hint to support this requirement. The field need not be registered in _source, just need to be searchable.

推荐答案

有 2 个步骤 - a dynamic_mapping 和一个 ingest_pipeline.

There are 2 steps to this -- a dynamic_mapping and an ingest_pipeline.

我假设您的字段 c 非常重要，因此您可能希望使用 match 并分配 keyword 映射给它:

I'm assuming your field c is non-trivial so you may want to match that field in a dynamic template using a match and assign the keyword mapping to it:

PUT synthetic
{
  "mappings": {
    "dynamic_templates": [
      {
        "c_like_field": {
          "match_mapping_type": "string",
          "match":   "c*",
          "mapping": {
            "type": "keyword"
          }
        }
      }
    ],
    "properties": {
      "a": {
        "type": "long"
      },
      "b": {
        "type": "long"
      }
    }
  }
}

然后您可以设置一个管道，它将连接您的 a &b:

Then you can set up a pipeline which'll concatenate your a & b:

PUT _ingest/pipeline/combined_ab
{
  "description" : "Concatenates fields a & b",
  "processors" : [
    {
      "set" : {
        "field": "c",
        "value": "{{_source.a}}_{{_source.b}}"
      }
    }
  ]
}

摄取新文档后(使用激活的管道！)

After ingesting a new doc (with the activated pipeline!)

POST synthetic/_doc?pipeline=combined_ab
{
  "a": 531351351351,
  "b": 251531313213
}

我们很高兴:

GET synthetic/_search

收益

{
  "a":531351351351,
  "b":251531313213,
  "c":"531351351351_251531313213"
}

也使用 GET 合成/_mapping 进行验证.

这篇关于Elasticsearch 可搜索合成字段的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！