elasticsearch - queryDSL-elasticsearch-必须与不能一起不能给出预期的结果

Question

Elasticsearch 7.8.1
要求
使用req_uri property equal to /api/data和不使用- in enduser_email提取文档
但是我收到的结果在-中有enduser_email 查询DSL

get infolog-2020-08-25/_search
{
  "_source" : ["req_uri","referrer","enduser_email","request_timestamp"],
  "query" : {
    "bool":{
      "must" : [
        {
          "match":{
            "req_uri" : "/api/data"
          }
        }
      ],
      "must_not": [
        {
          "match":{
            "enduser_email":  "-"
          }
        }
      ]
    }
  }
}

我的要求很简单，但我在Elasticsearch中为此查询苦苦挣扎
索引映射

Answer 1

您应该改为使用keyword子字段:

get infolog-2020-08-25/_search
{
  "_source" : ["req_uri","referrer","enduser_email","request_timestamp"],
  "query" : {
    "bool":{
      "must" : [
        {
          "match":{
            "req_uri.keyword" : "/api/data"
          }
        }
      ],
      "must_not": [
        {
          "match":{
            "enduser_email.keyword":  "-"
          }
        }
      ]
    }
  }
}