elasticsearch - 不确定如何使用嵌套属性构造 ElasticSearch 范围查询

Question

我在 ES 中的对象看起来像:

{
  "_index": "myIndex",
  "_type": "myType",
  "_id": "75fd98d2-eca7-4a94-9dd8-1cc2c9b1fbbf",
  "_version": 2,
  "found": true,
  "_source": {
    "account_id": "100",
    "import_ids": [
      "4f4eef42-5493-464e-ac08-68a3a25a01fb"
    ],
    "accept": "html",
    "deleted_at": null,
    "signup_form_ids": [
      {
        "timestamp": "2015-11-23T20:08:11.604000",
        "signup_form_id": "1234"
      }
    ],
    "mailing_status": "active",
    "group_ids": [
      "0eddd2c0-ce70-4eb7-bcd8-9e41e41ac0b3"
    ],
    "confirmed_opt_in_at": null,
    "fields": [
      {
        "text_value": "My Company",
        "name": "company"
      },
      {
        "text_value": "Foo",
        "name": "first-name"
      },
      {
        "text_value": "Bar",
        "name": "last_name"
      },
      {
        "text_value": "555-555-5555",
        "name": "phone"
      }
    ],
    "created_at": "2015-11-23T19:20:15.889000",
    "last_modified_at": "2015-11-23T20:08:11.604000",
    "bounce_count": 0,
    "opted_out_at": null,
    "archived_at": null,
    "email": "example@example.com",
    "opt_out_mailing_id": "None"
  }
}

我正在尝试编写一个查询，该查询为我提供 signup_form_ids.timestamp 为 lte now-7d/d 的所有匹配项。我在看 https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html#ranges-on-dates但不确定如何构造查询

这是我目前所拥有的:

{
    "query": {
        "nested": {
            "path": "signup_form_ids",
            "bool": {
                "must": [
                    {
                        "range": {
                            "timestamp" {
                                "lte": "now-7d/d"
                            }
                        }
                    }
                ]
            }
        },
        "bool": {
            "must": [
                {
                    "bool": {
                        "must": []
                    }
                },
                {
                    "match": {
                        "account_id": "100"
                    }
                },
                {
                    "filtered": {
                        "filter": {
                            "missing": {
                                "field": "deleted_at"
                            }
                        }
                    }
                }
            ]
        }
    },
    "size": 500,
    "from": 0
}

Answer 1

这里有几处错误，哪些是您调整查询以在此处发布的结果并不完全明显。

首先，"timestamp" 后面少了一个冒号在您的查询中。另外，你有一个空的内部 "bool" .还有你的"range"查询在一个不必要的 "bool" 里面.还有你的"filtered"子句是多余的，您可以只使用 "filter"里面。

但主要问题是 1) 你的 "nested"查询需要在您的 "bool" 内如果您希望所有条件都适用，2) 您的 "nested" "range" filter 需要指定到 "timestamp" 的完整路径和 3) "bool"在你的里面 "nested"子句需要在 "filter" 中.

因此，进行最小的调整以使查询正常工作，以下查询将返回您发布的文档(我将 "lte" 更改为 "gte" 因此将返回您发布的文档，否则它与查询不匹配, 然而):

POST /test_index/_search
{
   "query": {
      "bool": {
         "must": [
            {
               "bool": {
                  "must": []
               }
            },
            {
               "match": {
                  "account_id": "100"
               }
            },
            {
               "filtered": {
                  "filter": {
                     "missing": {
                        "field": "deleted_at"
                     }
                  }
               }
            },
            {
               "nested": {
                  "path": "signup_form_ids",
                  "filter": {
                     "bool": {
                        "must": [
                           {
                              "range": {
                                 "signup_form_ids.timestamp": {
                                    "gte": "now-7d/d"
                                 }
                              }
                           }
                        ]
                     }
                  }
               }
            }
         ]
      }
   },
   "size": 500,
   "from": 0
}

如果我清理它以删除所有冗余，我最终会得到:

POST /test_index/_search
{
   "query": {
      "bool": {
         "must": [
            {
               "match": {
                  "account_id": "100"
               }
            },
            {
               "missing": {
                  "field": "deleted_at"
               }
            },
            {
               "nested": {
                  "path": "signup_form_ids",
                  "filter": {
                     "range": {
                        "signup_form_ids.timestamp": {
                           "gte": "now-7d/d"
                        }
                     }
                  }
               }
            }
         ]
      }
   },
   "size": 500,
   "from": 0
}

这是我用来玩弄它的一些代码:

http://sense.qbox.io/gist/ee96042c0505dfb07199b919d134b2a20c5a66fd