elasticsearch - GoLang、elasticsearch多个查询参数

Question

我在 golang 中有一个项目，它从我们的服务器发送日志的 elastiearch 中获取日志。我有多个查询的问题。我想按两个字段查询，必须找到两个字段并过滤结果以获取两个时间戳之间的所有这些日志。在下面的代码中，将 deploymentName 对象附加到 Filter() 会导致根本没有结果。

import  ("github.com/olivere/elastic")


func main() {

client, err := elastic.NewClient(elastic.SetURL(*elasticUrl))


   //query by time
    timeQ := elastic.NewRangeQuery("@timestamp").From(from).To(to)

   //query by key named "component"
    componentQ := elastic.NewMatchQuery("component", *component)

    //query by key named "deploymentName", sam type as component
    deploymentQ := elastic.NewMatchQuery("deploymentName", deploymentName)

    //query object used for actual search later
    generalQ := elastic.NewBoolQuery().Should().
       Filter(timeQ).Filter(componentQ).Filter(deploymentQ)

        searchResult, err := client.Search().
                Index("some-index").
                From(from).Size(*chunk).
                Query(generalQ).
                Sort("@timestamp", true).
                Do(context.Background())
}

虽然 generalQuery 是这样写的，但它可以工作。

        //query object used for actual search later
    generalQ := elastic.NewBoolQuery().Should().
       Filter(timeQ).Filter(componentQ)

Answer 1

我目前是 Elasticsearch 的新手，但这种方式确实有效并在给定的时间范围内返回指定的组件和部署。

timeQ := elastic.NewRangeQuery("@timestamp").From(from).To(End)
componentQ := elastic.NewTermQuery("component", *component)
deploymentQ := elastic.NewTermQuery("deploymentName", deploymentName)

generalQ := elastic.NewBoolQuery()
generalQ = generalQ.Must(timeQ).Must(componentQ).Must(deploymentQ)