搜索查询弹性搜索 [英] Search query for elastic search
问题描述
{
stringindex:{
mappings:{
files:{
properties:{
BaseOfCode:{
type:long
}
BaseOfData:{
type:long
},
特征:{
type:long
},
FileType:{
type:long
},
Id:{
type:string
$ bStrings:{
properties:{
FileOffset:{
type:long
},
RO_BaseOfCode:{
type:long
},
SectionName:{
type:string
}
SectionOffset:{
type:long
},
String:{
type:string
}
},
SubSystem:{
type:long
}
}
}
}
}
}
我的要求是当我搜索一个特定的字符串(String.string)时,我只想获得该字符串的FileOffSet(String.FileOffSet)。
我如何做?
谢谢
我想你想执行一个嵌套查询,只检索一个字段作为结果,但是我看到你的映射问题,所以我会分三个部分我的答案:
- 我看到了什么问题:
- 如何查询嵌套字段(这更多是ES背景):
- 如何找到解决方案:
1)我看到了什么问题:
您要查询嵌套字段,但您没有嵌套字段。
嵌套字段部分
字段字符串不嵌套在类型文件中(没有嵌套字段的嵌套数据可能会带来未来的问题),否则您的Strings字段的映射将是这样的:
{
stringindex:{
mappings:{
files:{
properties :{
Strings:{
properties:{
type:nested,
String:{
type string
}
}
}
}
}
}
}
}
注意:是的,我剪切了大部分的字段,但是我这样做很容易显示你没有创建一个嵌套字段。
使用嵌套字段在手中,我们需要一个嵌套查询。
具体字段结果部分
要仅查询一个字段作为结果,您必须在查询中包含属性_source。
2)如何查询嵌套字段
这更适用于ES背景,如果您从未与嵌套字段一起工作。
小例子
一个嵌套字段:
{
nesttype :{
properties:{
name:{type:string},
parents:{
type ,
properties:{
sex:{type:string},
name:{type:string}
}
}
}
}
}
你创建一些输入:
{name:Dan,parents:[{name ,sex:m},
{name:Anna,sex:f}]}
{name:Lana 父母:[{name:Maria,sex:f}]}
然后您查询,但只能获取嵌套字段parents.name:
{
查询:{
nested:{
path:parents,
query:{
bool:{
must [
{
term:{
sex:m
}
}
]
}
}
}
},
_source:[parents.name]
}
这个查询的输出是所有有性别父母的人的父母的姓名。一个条目(丹)有一个父亲,而另一个(拉娜)没有。所以它只会检索Dan的父母姓名。
3)如何找到解决方案:
要修复您的映射:
您只需要在字符串字段中包含嵌套类型: p>
{
files:{
properties:{
...
Strings:{
type:nested,
properties:{
FileOffset:{type:long},
RO_BaseOfCode:{type:long},
...
}
}
...
}
}
}
要查询您的数据:
{
查询:{
嵌套:{
path:Strings,
query:{
bool:{
must:[
{
term:{
String:我的字符串
}
}
]
}
}
}
},
_source:[Strings.FileOffSet]
}
I have documents in elastic search in the following format
{
"stringindex" : {
"mappings" : {
"files" : {
"properties" : {
"BaseOfCode" : {
"type" : "long"
},
"BaseOfData" : {
"type" : "long"
},
"Characteristics" : {
"type" : "long"
},
"FileType" : {
"type" : "long"
},
"Id" : {
"type" : "string"
},
"Strings" : {
"properties" : {
"FileOffset" : {
"type" : "long"
},
"RO_BaseOfCode" : {
"type" : "long"
},
"SectionName" : {
"type" : "string"
},
"SectionOffset" : {
"type" : "long"
},
"String" : {
"type" : "string"
}
}
},
"SubSystem" : {
"type" : "long"
}
}
}
}
} }
My requirement is when I search for a particular string (String.string) i want to get only the FileOffSet (String.FileOffSet) for that string. How do i do this?
Thanks
I suppose that you want to perform a nested query and retrieve only one field as the result, but I see problems in your mapping, hence I will split my answer in 3 sections:
- What is the problem I see:
- How to query nested fields (this is more ES background):
- How to find a solution:
1) What is the problem I see:
You want to query a nested field, but you don't have a nested field.
The nested field part:
The field "Strings" is not nested in the type "files" (nested data without a nested field may bring future problems), otherwise your mapping for the field "Strings" would be something like this:
{
"stringindex" : {
"mappings" : {
"files" : {
"properties" : {
"Strings" : {
"properties" : {
"type" : "nested",
"String" : {
"type" : "string"
}
}
}
}
}
}
}
}
Note: yes, I cut most of the fields, but I did this to easily show that you didn't create a nested field.
With a nested field "in hands", we need a nested query.
The specific field result part:
To retrieve only one field as result, you have to include the property "_source" in your query.
2) How to query nested fields:
This is more for ES background, if you have never worked with nested fields.
Small example:
You define a type with a nested field:
{
"nesttype" : {
"properties" : {
"name" : { "type" : "string" },
"parents" : {
"type" : "nested" ,
"properties" : {
"sex" : { "type" : "string" },
"name" : { "type" : "string" }
}
}
}
}
}
You create some inputs:
{ "name" : "Dan", "parents" : [{ "name" : "John" , "sex" : "m" },
{ "name" : "Anna" , "sex" : "f" }] }
{ "name" : "Lana", "parents" : [{ "name" : "Maria" , "sex" : "f" }] }
Then you query, but only fetch the nested field "parents.name":
{
"query": {
"nested": {
"path": "parents",
"query": {
"bool": {
"must": [
{
"term": {
"sex": "m"
}
}
]
}
}
}
},
"_source" : [ "parents.name" ]
}
The output of this query is "the name of the parents of all people who have a parent of the sex 'm' ". One entry (Dan) has a father, whereas the other (Lana) doesn't. So it only will retrieve Dan's parents names.
3) How to find a solution:
To fix your mapping:
You only need to include the type "nested" in the field "Strings":
{
"files" : {
"properties" : {
...
"Strings" : {
"type" : "nested" ,
"properties" : {
"FileOffset" : { "type" : "long" },
"RO_BaseOfCode" : { "type" : "long" },
...
}
}
...
}
}
}
To query your data:
{
"query": {
"nested": {
"path": "Strings",
"query": {
"bool": {
"must": [
{
"term": {
"String": "my string"
}
}
]
}
}
}
},
"_source" : [ "Strings.FileOffSet" ]
}
这篇关于搜索查询弹性搜索的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!