gpt4 book ai didi

elasticsearch - 检查一个字段是否存在以及另一个字段是否与Elasticsearch文档中的字符串匹配的最佳方法?

转载 作者:行者123 更新时间:2023-12-02 23:25:43 26 4
gpt4 key购买 nike

#First Document  
{ "fullname":"John", "age":70, "car":{"model":{"nickname":"nevan"}}}
#Second Document

{ "fullname":"Bala", "age":30, "car":{"model":{"nickname":"jessica"}}}

#Third Document

{ "fullname":"Bala", "age":25, "car":{"model":{"nickname":"hilica"}}}

#Fourth Document

{ "fullname":"Bala", "age":30 }

1.查询应确保存在具有字段car.model.nickname且全名为“Bala”的返回文档。
2.答案应为第二和第三份文件。

我尝试了以下两个匹配项或术语,但没有用
GET index-bala/_search
{
"query" : {
"bool": {
"must" : [
{ "exists": { "field": "car.model.nickname" } },
{ "term" : { "fullname": "bala"} }

]
}
}
}

我试图找到解决方案而不使问题复杂化。
这是真实的例子。
查询要求是字段“content.system.cpu”存在且主机名值等于“balahost1.com”

其类似于公制节拍映射:
{
"index-bala": {
"mappings": {
"type-bala": {
"properties": {
"@timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"content": {
"properties": {
"@timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"@version": {
"type": "string"
},
"beat": {
"properties": {
"hostname": {
"type": "string"
},
"name": {
"type": "string"
},
"version": {
"type": "string"
}
}
},
"host": {
"type": "string"
},
"metricset": {
"properties": {
"module": {
"type": "string"
},
"name": {
"type": "string"
},
"rtt": {
"type": "long"
}
}
},
"system": {
"properties": {
"cpu": {
"properties": {
"cores": {
"type": "long"
},
"idle": {
"properties": {
"pct": {
"type": "double"
}
}
},
"iowait": {
"properties": {
"pct": {
"type": "double"
}
}
},
"irq": {
"properties": {
"pct": {
"type": "long"
}
}
},
"nice": {
"properties": {
"pct": {
"type": "long"
}
}
},
"softirq": {
"properties": {
"pct": {
"type": "double"
}
}
},
"steal": {
"properties": {
"pct": {
"type": "long"
}
}
},
"system": {
"properties": {
"pct": {
"type": "double"
}
}
},
"user": {
"properties": {
"pct": {
"type": "double"
}
}
}
}
},
"filesystem": {
"properties": {
"available": {
"type": "long"
},
"device_name": {
"type": "string"
},
"files": {
"type": "long"
},
"free": {
"type": "long"
},
"free_files": {
"type": "long"
},
"mount_point": {
"type": "string"
},
"total": {
"type": "long"
},
"used": {
"properties": {
"bytes": {
"type": "long"
},
"pct": {
"type": "long"
}
}
}
}
},
"memory": {
"properties": {
"actual": {
"properties": {
"free": {
"type": "long"
},
"used": {
"properties": {
"bytes": {
"type": "long"
},
"pct": {
"type": "double"
}
}
}
}
},
"free": {
"type": "long"
},
"swap": {
"properties": {
"free": {
"type": "long"
},
"total": {
"type": "long"
},
"used": {
"properties": {
"bytes": {
"type": "long"
},
"pct": {
"type": "double"
}
}
}
}
},
"total": {
"type": "long"
},
"used": {
"properties": {
"bytes": {
"type": "long"
},
"pct": {
"type": "double"
}
}
}
}
},
"process": {
"properties": {
"cmdline": {
"type": "string"
},
"cpu": {
"properties": {
"start_time": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"total": {
"properties": {
"pct": {
"type": "long"
}
}
}
}
},
"fd": {
"properties": {
"limit": {
"properties": {
"hard": {
"type": "long"
},
"soft": {
"type": "long"
}
}
},
"open": {
"type": "long"
}
}
},
"memory": {
"properties": {
"rss": {
"properties": {
"bytes": {
"type": "long"
},
"pct": {
"type": "long"
}
}
},
"share": {
"type": "long"
},
"size": {
"type": "long"
}
}
},
"name": {
"type": "string"
},
"pgid": {
"type": "long"
},
"pid": {
"type": "long"
},
"ppid": {
"type": "long"
},
"state": {
"type": "string"
},
"username": {
"type": "string"
}
}
}
}
},
"tags": {
"type": "string"
},
"type": {
"type": "string"
}
}
},
"hostname": {
"type": "string"
},
"service": {
"type": "string"
}
}
}
}
}
}

样本数据:

资料1:
{
"@timestamp": "2017-04-25T10:13:35.536Z",
"content": {
"metricset": {
"name": "memory",
"rtt": 173,
"module": "system"
},
"beat": {
"version": "5.2.2",
"name": "balahost1.com",
"hostname": "balahost1.com"
},
"@timestamp": "2017-04-25T10:13:33.180Z",
"type": "metricsets",
"system": {
"memory": {
"used": {
"bytes": 3219914752,
"pct": 0.8117
},
"free": 747134976,
"actual": {
"free": 1879838720,
"used": {
"pct": 0.5261,
"bytes": 2087211008
}
},
"swap": {
"used": {
"bytes": 200433664,
"pct": 0.0482
},
"free": 3960311808,
"total": 4160745472
},
"total": 3967049728
}
},
"@version": "1",
"host": "balahost1.com",
"tags": [
"beats_input_raw_event"
]
},
"hostname": "balahost1.com",
"service": "index-bala"
}

数据2
{
"@timestamp": "2017-04-25T10:13:35.532Z",
"content": {
"@timestamp": "2017-04-25T10:13:33.179Z",
"type": "metricsets",
"system": {
"cpu": {
"nice": {
"pct": 0.0001
},
"system": {
"pct": 0.0121
},
"iowait": {
"pct": 0.0012
},
"irq": {
"pct": 0
},
"steal": {
"pct": 0
},
"softirq": {
"pct": 0.0002
},
"cores": 2,
"user": {
"pct": 0.0189
},
"idle": {
"pct": 0.9675
}
}
},
"metricset": {
"module": "system",
"name": "cpu",
"rtt": 201
},
"beat": {
"name": "balahost1.com",
"hostname": "balahost1.com",
"version": "5.2.2"
},
"@version": "1",
"host": "balahost1.com",
"tags": [
"beats_input_raw_event"
]
},
"hostname": "balahost1.com",
"service": "index-bala"
}

资料3:
{
"@timestamp": "2017-04-25T10:13:35.536Z",
"content": {
"metricset": {
"name": "memory",
"rtt": 173,
"module": "system"
},
"beat": {
"version": "5.2.2",
"name": "balahost2.com",
"hostname": "balahost2.com"
},
"@timestamp": "2017-04-25T10:13:33.180Z",
"type": "metricsets",
"system": {
"memory": {
"used": {
"bytes": 3219914752,
"pct": 0.8117
},
"free": 747134976,
"actual": {
"free": 1879838720,
"used": {
"pct": 0.5261,
"bytes": 2087211008
}
},
"swap": {
"used": {
"bytes": 200433664,
"pct": 0.0482
},
"free": 3960311808,
"total": 4160745472
},
"total": 3967049728
}
},
"@version": "1",
"host": "balahost2.com",
"tags": [
"beats_input_raw_event"
]
},
"hostname": "balahost2.com",
"service": "index-bala"
}

数据4
{
"@timestamp": "2017-04-25T10:13:35.532Z",
"content": {
"@timestamp": "2017-04-25T10:13:33.179Z",
"type": "metricsets",
"system": {
"cpu": {
"nice": {
"pct": 0.0001
},
"system": {
"pct": 0.0121
},
"iowait": {
"pct": 0.0012
},
"irq": {
"pct": 0
},
"steal": {
"pct": 0
},
"softirq": {
"pct": 0.0002
},
"cores": 2,
"user": {
"pct": 0.0189
},
"idle": {
"pct": 0.9675
}
}
},
"metricset": {
"module": "system",
"name": "cpu",
"rtt": 201
},
"beat": {
"name": "balahost2.com",
"hostname": "balahost2.com",
"version": "5.2.2"
},
"@version": "1",
"host": "balahost2.com",
"tags": [
"beats_input_raw_event"
]
},
"hostname": "balahost2.com",
"service": "index-bala"
}

在不修改映射的情况下找到的最终答案如下。
GET index-bala/_search
{
"min_score": 1.0,
"query": {

"bool": {
"must": [
{
"term": {
"hostname": "balahost1.com"
}

},
{
"exists": {
"field": "content.system.cpu"
}
}
]
}
}
}

最佳答案

这应该为你工作

{
"query" : {
"bool": {
"must" : [
{ "term" : { "name" : "Bala" } },
{ "exists": { "field": "car" } }
]
}
}
}

编辑 hostname字段的映射为 {"type": "string"},这意味着将对该字段进行分析,如果您要搜索 {match: {"hostname":"xxxxhostname.com"}},则比结果还包括字段名称为 "anyhost.com"的文档(有关更多详细信息,请参见elasticsearch analyzers)。原因是elasticsearch的分析器。同样,您无法在已分析的字段上使用术语查询进行搜索。

您需要存储 hostname字段的未分析值,以便能够对其执行 term查询。据我了解,您使用的是Elasticsearch的2.x版本,因此 documentation link也适用。您需要类似 hostname字段映射的内容
"hostname": {
"type": "string",
"fields": {
"raw": {
"type": "string",
"index": "not_analyzed"
}
}
}

并且您需要查询的不是 hostname,而是查询 hostname.rawterm

或者,如果您不对 hostname进行分析,则可以使其不被分析并对其进行查询
"hostname": {
"type": "string",
"index": "not_analyzed"
}

关于elasticsearch - 检查一个字段是否存在以及另一个字段是否与Elasticsearch文档中的字符串匹配的最佳方法?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/43596061/

26 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com