elasticsearch - ElasticSearch查询带有多个文档的条件

Question

我在elasticsearch中有这种格式的数据，每个都在单独的文件中:

{'pid':1，'nm':'tom'}，{'pid':1，'nm':'dick'}，{'pid':1，1，'nm':'harry'}，{ 'pid':2，'nm':'tom'}，{'pid':2，'nm':'harry'}，{'pid':3，'nm':'dick'}，{'pid ':3，'nm':'harry'}，{'pid':4，'nm':'harry'}

    {
       "took": 137,
       "timed_out": false,
       "_shards": {
          "total": 5,
          "successful": 5,
          "failed": 0
       },
       "hits": {
          "total": 8,
          "max_score": null,
          "hits": [
             {
                "_index": "query_test",
                "_type": "user",
                "_id": "AVj9KS86AaDUbQTYUmwY",
                "_score": null,
                "_source": {
                   "pid": 1,
                   "nm": "Harry"
                }
             },
             {
                "_index": "query_test",
                "_type": "user",
                "_id": "AVj9KJ9BAaDUbQTYUmwW",
                "_score": null,
                "_source": {
                   "pid": 1,
                   "nm": "Tom"
                }
             },
             {
                "_index": "query_test",
                "_type": "user",
                "_id": "AVj9KRlbAaDUbQTYUmwX",
                "_score": null,
                "_source": {
                   "pid": 1,
                   "nm": "Dick"
                }
             },
             {
                "_index": "query_test",
                "_type": "user",
                "_id": "AVj9KYnKAaDUbQTYUmwa",
                "_score": null,
                "_source": {
                   "pid": 2,
                   "nm": "Harry"
                }
             },
             {
                "_index": "query_test",
                "_type": "user",
                "_id": "AVj9KXL5AaDUbQTYUmwZ",
                "_score": null,
                "_source": {
                   "pid": 2,
                   "nm": "Tom"
                }
             },
             {
                "_index": "query_test",
                "_type": "user",
                "_id": "AVj9KbcpAaDUbQTYUmwb",
                "_score": null,
                "_source": {
                   "pid": 3,
                   "nm": "Dick"
                }
             },
             {
                "_index": "query_test",
                "_type": "user",
                "_id": "AVj9Kdy5AaDUbQTYUmwc",
                "_score": null,
                "_source": {
                   "pid": 3,
                   "nm": "Harry"
                }
             },
             {
                "_index": "query_test",
                "_type": "user",
                "_id": "AVj9KetLAaDUbQTYUmwd",
                "_score": null,
                "_source": {
                   "pid": 4,
                   "nm": "Harry"
                }
             }
          ]
       }
    }

而且我需要找到具有“harry”但没有“tom”的pid，在上面的示例中为3和4。从本质上来说，这意味着要查找具有相同pid的文档，而这些文件都没有nm且值为“tom” ”，但其中至少有一个具有“哈里”值的nm。

我该如何查询？

编辑:使用Elasticsearch版本5

Answer 1

如果您有一个POST请求主体，该主体看起来可能如下所示，该处您可以使用bool怎么办:

POST _search
{
  "query": {
    "bool" : {
      "must" : {
        "term" : { "nm" : "harry" }
      },
      "must_not" : {
        "term" : { "nm" : "tom" }
      }
    }
  }
}