弹性搜索连词问题与术语过滤器 [英] Elastic Search Hyphen issue with term filter

问题描述

我有以下Elastic Search查询，只有一个术语过滤器。我的查询更复杂，但我只是想在这里显示问题。

  {
filter： {
term：{
field：update-time
} 
} 
} 
  / pre> 
 
 
当我将连字符值传递给过滤器时，我会得到零结果。但是，如果我尝试没有未连接的值，我会得到结果。我不知道连字符是否是这里的一个问题，但我的情况让我相信。 
 
 
 
有没有办法逃避连字符，所以过滤器会返回结果？我已经尝试用我从Lucene论坛读取的反斜杠逃脱连字符，但没有帮助。 
 
 
 
此外，如果我将GUID值传入该字段，该字段被连字符并被花括号括起来，像 -  {ASD23-34SD-DFE1-42FWW}我需要小写字母字符，我需要摆脱大括号吗？
 
 
 
谢谢
解决方案
我会猜测你的字段是分析的，这是弹性搜索中的字符串字段的默认设置。因此，当它被索引时，它没有被索引为一个术语更新时间，而是作为2个术语：更新和时间。这就是为什么你的术语搜索找不到这个词。如果您的字段将始终包含必须完全匹配的值，则最好在映射中定义此字段为未分析。您可以通过使用新的映射重新创建索引：
  curl -XPUT http：// localhost：9200 / your-index -d{
映射：{
your-type：{
properties：{
field：{type：string index：not_analyzed} 
} 
} 
} 
}'
 
 curl -XPUT http：// localhost：9200 / your- index / your-type / 1 -d'{
field：update-time
}'
 
 curl -XPOST http：// localhost：9200 / your -index / your-type / _search -d'{
filter：{
term：{
field：update-time
} 
} 
}'
  
或者，如果您希望在基于这个字段，你可以保持这个字段分析并使用文本查询：
  curl -XPOST http：// localhost：9200 / your-index / your-type / _search -d'{
query：{
text：{ 
field：update-time
} 
} 
}'
  
请记住，如果您的字段被分析，则可以通过搜索更新或时间字来找到该记录。
 
I have the following Elastic Search query with only a term filter. My query is much more complex but I am just trying to show the issue here.
{
    "filter": {
            "term": {
                    "field": "update-time"
                }
        }
}
When I pass in a hyphenated value to the filter, I get zero results back. But if I try without an unhyphenated value I get results back. I am not sure if the hyphen is an issue here but my scenario makes me believe so. 

Is there a way to escape the hyphen so the filter would return results? I have tried escaping the hyphen with a back slash which I read from the Lucene forums but that didn't help. 

Also, if I pass in a GUID value into this field which is hyphenated and surrounded by curly braces, something like - {ASD23-34SD-DFE1-42FWW}, would I need to lower case the alphabet characters and would I need to escape the curly braces too?

Thanks
解决方案
I would guess that your field is analyzed, which is default setting for string fields in elasticsearch. As a result, when it indexed it's not indexed as one term "update-time" but instead as 2 terms: "update" and "time". That's why your term search cannot find this term. If your field will always contain values that will have to be matched completely as is, it would be the best to define such field in mapping as not analyzed. You can do it by recreating the index with new mapping:
curl -XPUT http://localhost:9200/your-index -d '{
    "mappings" : {
        "your-type" : {
            "properties" : {
                "field" : { "type": "string", "index" : "not_analyzed" }
            }
        }
    }
}'

curl -XPUT  http://localhost:9200/your-index/your-type/1 -d '{
    "field" : "update-time"
}'

curl -XPOST http://localhost:9200/your-index/your-type/_search -d'{
    "filter": {
        "term": {
                "field": "update-time"
        }
    }
}'
Alternatively, if you want some flexibility in finding records based on this field, you can keep this field analyzed and use text queries instead:
curl -XPOST http://localhost:9200/your-index/your-type/_search -d'{
    "query": {
        "text": {
                "field": "update-time"
        }
    }
}'
Please, keep in mind that if your field is analyzed then this record will be found by searching for just word "update" or word "time" as well.

                        
这篇关于弹性搜索连词问题与术语过滤器的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！