elasticsearch - Elasticsearch分析器

Question

在 flex 搜索前缀查询中，使用大写字符不返回结果的搜索。我没有在映射中定义任何分析器，并假设 flex 搜索将对索引和搜索使用默认映射。

{
  "access-event-logs_2016-02-08t00:00:00-08:00": {
    "mappings": {
      "session-summary": {
        "dynamic_templates": [
          {
            "long_1": {
              "mapping": {
                "type": "long"
              },
              "match": "generation"
            }
          },
          {
            "datetime_1": {
              "mapping": {
                "format": "strict_date_optional_time||epoch_millis",
                "type": "date"
              },
              "match": "*DateTime"
            }
          },
          {
            "string_1": {
              "mapping": {
                "index": "not_analyzed",
                "type": "string"
              },
              "match": "*"
            }
          }
        ],
        "properties": {
          "Access_Policy_Result": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Bytes_In": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Bytes_Out": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Client_IP": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Client_Platform": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Continent": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Country": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Partition": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Reputation": {
            "type": "string",
            "index": "not_analyzed"
          },
          "State": {
            "type": "string",
            "index": "not_analyzed"
          },
          "User_Name": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Virtual_IP": {
            "type": "string",
            "index": "not_analyzed"
          },
          "accessProfile": {
            "type": "string",
            "index": "not_analyzed"
          },
          "active": {
            "type": "string",
            "index": "not_analyzed"
          },
          "badIpReputation": {
            "type": "string",
            "index": "not_analyzed"
          },
          "clusterName": {
            "type": "string",
            "index": "not_analyzed"
          },
          "duration": {
            "type": "string",
            "index": "not_analyzed"
          },
          "eventConversionDateTime": {
            "type": "date",
            "format": "strict_date_optional_time||epoch_millis"
          },
          "generation": {
            "type": "long"
          },
          "hostname": {
            "type": "string",
            "index": "not_analyzed"
          },
          "lastUpdateMicros": {
            "type": "string",
            "index": "not_analyzed"
          },
          "sessionDuration": {
            "type": "string",
            "index": "not_analyzed"
          },
          "sessionKey": {
            "type": "string",
            "index": "not_analyzed",
            "include_in_all": false
          },
          "sessionTerminationDateTime": {
            "type": "date",
            "format": "strict_date_optional_time||epoch_millis"
          },
          "session_id": {
            "type": "string",
            "index": "not_analyzed"
          },
          "unique_id": {
            "type": "string",
            "index": "not_analyzed",
            "include_in_all": false
          },
          "virtualServer": {
            "type": "string",
            "index": "not_analyzed"
          }
        }
      }
    }
  }
}

该查询返回结果，但如果我使用Common而不是(common)进行搜索，
没有结果返回。我是否需要指定任何分析器来执行不区分大小写的搜索

{
      "query":{  
         "filtered":{  
            "filter":{  
               "bool":{  
                  "must":[  
                     {  
                        "range":{  
                           "eventConversionDateTime":{  
                              "gte":"2015-10-30T02:50:39.237Z",
                              "lte":"2015-12-31T02:50:38.237Z"
                           }
                        }
                     }
                       {  
                        "prefix":{  
                               "_all":"common"

                        }
                     }
                  ]
               }
            }
         }
      }

Answer 1

查看您的文档，iirc ES在索引文档时会小写所有内容。还可以使用匹配查询，它会处理匹配所需的圈。