弹性搜寻查询中的完全比对 [英] Exact match in elastic search query

问题描述

我想完全匹配 message 字段中的字符串：Feed： 并返回一天拉所有这些记录。我所拥有的json似乎也与普通单词 feed 相匹配。我不确定我要去哪里。我是否需要向该查询JSON添加 constant_score ？我当前拥有的JSON如下所示：

I want to exactly match the string ":Feed:" in a message field and go back a day pull all such records. The json I have seems to also match the plain word " feed ". I am not sure where I am going wrong. Do I need to add "constant_score" to this query JSON? The JSON I have currently is as shown below:

{
    "query": {
        "bool": {
            "must": {
                "query_string": {
                    "fields": ["message"],
                    "query": "\\:Feed\\:"
                }
            },
            "must": {
                "range": {
                    "timestamp": {
                        "gte": "now-1d",
                        "lte": "now"
                    }
                }
            }
        }
    }
}

推荐答案

如此处所述：查找精确值，因为对字段进行索引时已对其进行了分析-您无法准确-匹配其令牌（：）。每当令牌应可搜索时，映射应为 not_analyzed，并且数据需要重新索引。

As stated here: Finding Exact Values, since the field has been analyzed when indexed - you have no way of exact-matching its tokens (":"). Whenever the tokens should be searchable the mapping should be "not_analyzed" and the data needs to be re-indexed.

如果您希望能够轻松地仅匹配： feed：，您可能希望对没有标记化：的分析器进行总体化，这样您就可以使用简单的匹配查询而不是通配符查询该字段。

If you want to be able to easily match only ":feed:" inside the message field you might want to costumize an analyzer which doesn't tokenize ":" so you will be able to query the field with a simple "match" query instead of wild characters.

这篇关于弹性搜寻查询中的完全比对的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！