elasticsearch - Elasticsearch 中具有不同路径的AND/OR嵌套查询

Question

我在 flex 搜索中有些嵌套的对象。我正在尝试找到使用bool查询对它们进行“与” /“或”运算的有效方法。

下面是我的映射

sample:
   type:nested
   properties:
    vendor_detections: 
        type: "nested"
        properties:
            vendor_name: 
                type: string
            signature:
                type:nested
                properties:
                    name:
                        type:string

我正在尝试的查询是给我所有被供应商检测为“Microsoft”包含字符串“Win32”的示例。以下是我尝试过的查询

GET /my_index/sample/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "nested": {
            "path": "vendor_detections",
            "query": {
              "match": {
                    "vendor_detections.vendor_name": "microsoft"
               }
            }
          }
        },
        {
          "nested": {
            "path": "vendor_detections.signature",
            "query": {
              "wildcard": {
                    "vendor_detections.signature.name": "Win32*"
               }
            }
          }
        },


      ]
    }
  }
}

包含文档“vendor_detections”的“样本”

{
  "md5sum": ""
  "vendor_detections": [{
      "vendor_name": "symantec",
      "service_name": "spw",
      "signature": {
          "name": "W32.Wapomi!inf",
          "threat": {
              "vulnerabilities": [],
              "threat_category": {
                  "name": "Unknown"
              },
              "targets": []
          }
      }
  }, {
      "vendor_name": "kaspersky",
      "service_name": "spw",
      "signature": {
          "name": "Virus.Win32.Qvod.f",
          "threat": {
              "vulnerabilities": [],
              "threat_category": {
                  "name": "Unknown"
              },
              "targets": []
          }
      }
  }, {
      "vendor_name": "bitdefender",
      "service_name": "spw",
      "signature": {
          "name": "Win32.Viking.AX",
          "threat": {
              "vulnerabilities": [],
              "threat_category": {
                  "name": "Unknown"
              },
              "targets": []
          }
      }
  }]
}

但是，这将返回所有示例，这些示例中我在应用程序中使用的4个供应商之一的签名都包含字符串“Win32”。我该如何解决？

Answer 1

根据您问题中的信息，即映射和示例文档，由于每个嵌套signature对象只有一个，因此没有理由将vendor_detections声明为嵌套对象。