ELASTICSEARCH-根据值返回过滤的字段 [英] ELASTICSEARCH- Return filtered fields based on values
问题描述
我正在开发一个查询，其中我想识别 CES中的那些字段，这些字段显示在 ces.des字段中。或 ces.output值 jack
I am developing a query in which I would like to identify those fields within "CES", those that show in the field "ces.des" or "ces.output" the value "jack"
{"_source": ["ces.desc","ces.output"] ,
"query": {
"nested": {
"path": "ces",
"query": {
"bool": {
"should": [
{"term": {"ces.desc": "jack"}},
{"term": {"ces.output": "jack"}}
]
}
}
}
},
"aggs": {
"nestedData": {
"nested": {
"path": "ces"
},
"aggs": {
"data_desc": {
"filter": {
"term": {
"ces.desc": "jack"
}
}
}
}
}
}
}
输出为：
{
"ces" : [
{
"output" : "Laura", <-------------- WRONG
"desc" : "fernando" <-------------- WRONG
},
{
"output" : "",
"desc" : "jack" <-------------- RIGHT
}
"output" : "jack",<-------------- RIGHT
"desc" : "Fer"
},
}
映射：
{
"names_1" : {
"aliases" : { },
"mappings" : {
"properties" : {
"created_at" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"data" : {
"properties" : {
"addresses" : {
"properties" : {
"asn" : {
"type" : "long"
},
"ces" : {
"type" : "nested",
"properties" : {
"banner" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"desc" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"output" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
},
"name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"source" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"tag" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"error" : {
"type" : "long"
},
"finished_at" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"total" : {
"type" : "long"
}
}
}
}
}
我只想过滤那些符合那些根据``布尔值''表示值的值的那些值。健康）状况。
if（ces.desc == jack）或（ces.output == jack）
返回
ces.desc，ces.output键和值
I would like to filter only those that comply that present the values according to the "bool" condition. if (ces.desc == "jack") or (ces.output == "jack)" return ces.desc,ces.output key and value
即使我添加 agg，也要输入 JACK。 count
doc_value = 2
Even if I add"agg", make a "JACK" count doc_value = 2
我在查询的哪一部分出错？
What part of the query am I making the error?
查询映射：
{
"mappings": {
"properties": {
"data.addresses":{
"type":"nested",
"properties": {
"data.addresses.ces": {
"type": "nested"
}
}
}
}
}
}
推荐答案
您需要将映射更改为以下内容，即两个地址 AND ces 需要被嵌套 ：
You need to change your mapping to the following, i.e. BOTH addresses AND ces need to be nested:
{
"aliases": {},
"mappings": {
"properties": {
"created_at": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"data": {
"properties": {
"addresses": {
"type": "nested", <------ MUST BE NESTED
"properties": {
"asn": {
"type": "long"
},
"ces": {
"type": "nested", <------ MUST BE NESTED
"properties": {
"banner": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"desc": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"output": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
},
"name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"source": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"tag": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"error": {
"type": "long"
},
"finished_at": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"total": {
"type": "long"
}
}
}
}
然后，您只需要使用嵌套 inner_hits ：
Then you simply need to use nested inner_hits:
{
"_source": false,
"query": {
"nested": {
"path": "data.addresses.ces",
"inner_hits": {}, <---- ADD THIS
"query": {
"bool": {
"should": [
{
"term": {
"data.addresses.ces.desc": "jack"
}
},
{
"term": {
"data.addresses.ces.output": "jack"
}
}
]
}
}
}
},
"aggs": {
"nestedData": {
"nested": {
"path": "data.addresses.ces"
},
"aggs": {
"data_desc": {
"filter": {
"term": {
"data.addresses.ces.desc": "jack"
}
}
}
}
}
}
}
响应仅包含嵌套的内部匹配，其中包含 jack
And the response will only contain the nested inner hits containing jack
这篇关于ELASTICSEARCH-根据值返回过滤的字段的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
