elasticsearch - 需要帮助以在字段上正确执行通配符搜索

Question

我的sData.Name映射如下所示:

{
    "abc_history": {
        "mappings": {
            "abc-data-type": {
                "sData.Name": {
                    "full_name": "sData.Name",
                    "mapping": {
                        "Name": {
                            "type": "text",
                            "fields": {
                                "keyword": {
                                    "type": "keyword",
                                    "ignore_above": 256
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}

我的 sData.startDate映射如下所示

{
    "abc_history": {
        "mappings": {
            "abc-data-type": {
                "sData.startDate": {
                    "full_name": "sData.startDate",
                    "mapping": {
                        "startDate": {
                            "type": "date"
                        }
                    }
                }
            }
        }
    }
}

我正在尝试对 sData.Name执行通配符搜索，并使用以下查询:

{
  "from": 0, 
  "size": 20, 
        "query": {
          "bool": {
            "must":[
              {"range": {"requestDate": { "gte": "2019-10-01T08:00:00.000Z" }}},
              {
                "wildcard": {
                  "sData.Name": "*Scream*"
                }
              }
            ]
          }
        },
        "sort": [
          { "requestDate": {"order": "desc"}}
        ]
}

上面的查询返回空响应。
我应该如何修改查询，以便可以对 wildcard search执行 sData.Name http://{serverhost}:{port}/abc_history/_search的响应如下所示:

{
  "took": 181,
  "timed_out": false,
  "_shards": {
    "total": 3,
    "successful": 3,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 1,
    "max_score": null,
    "hits": [
      {
        "_index": "abc_history",
        "_type": "abc-data-type",
        "_id": "5e29cbb7965809fe6cb22a7b",
        "_score": null,
        "_source": {
          "sData": [
            {
              "status": "ASSIGNED",
              "Name": "CloudView abcmission Automation Support",
              startDate : "2020-01-26T20:12:57.091Z"

            },
            {
              "status": "RESOLVED",
              "Name": "DSE - Tools Engineering",
              startDate : "2020-01-27T20:12:57.091Z" 
            },
            {
              "status": "CLOSED",
              "Name": "abcmission Orchestration",
              startDate : "2020-01-29T20:12:57.091Z"
            },
            {
              "status": "ASSIGNED",
              "Name": "CloudView abcmission Automation Support",
              startDate : "2020-01-29T20:19:29.687Z"
            }
          ]
        },
        "sort": [
          1579797431366
        ]
      }
    ]
  }
}

我主要关心查询 sData.Name。我只想在最后一个数组元素中执行搜索。因此，在我的情况下，我只想搜索 sData[3].Name。换句话说，应仅在 DSE中搜索关键字 "Name": "CloudView abcmission Automation Support"

Answer 1

我尝试通过您的输入创建索引。尝试使用

"wildcard": {
    "sData.Name.keyword": {
    "wildcard": "*DSE*",
        "boost": 1
    }
}

完整查询为:

PUT /abc_history
{
  "mappings": {
    "abc-data-type": {
      "properties": {
        "sData": {
          "properties": {
            "status": {
              "type": "keyword"
            },
            "Name": {
              "type": "text",
              "fields": {
                     "keyword": {
                          "type": "keyword",
                          "ignore_above": 256
                        }
                }
            }
          }
        }
      }
    }
  }
}


GET /abc_history/_search
{
    "from": 0,
    "size": 200,
    "query": {
        "bool": {
            "filter": [
                {
                    "bool": {
                        "must": [
                            {
                                "wildcard": {
                                    "sData.Name.keyword": {
                                        "wildcard": "*DSE*",
                                        "boost": 1
                                    }
                                }
                            }
                        ],
                        "adjust_pure_negative": true,
                        "boost": 1
                    }
                }
            ],
            "adjust_pure_negative": true,
            "boost": 1
        }
    }
}

有可能

GET /abc_history/_search
{
    "from": 0,
    "size": 200,
    "query": {
        "bool": {
            "filter": [
                {
                    "bool": {
                        "must": [
                            {
                                "wildcard": {
                                    "sData.Name": {
                                        "wildcard": "*ddd*",
                                        "boost": 1
                                    }
                                }
                            }
                        ],
                        "adjust_pure_negative": true,
                        "boost": 1
                    }
                }
            ],
            "adjust_pure_negative": true,
            "boost": 1
        }
    },
    "sort": [
        {
            "sData.startDate": {
                "order": "asc"
            }
        }
    ]
}