elasticsearch - 搜索嵌套对象

Question

我无法在Elasticsearch 7.3上进行查询

我这样创建一个索引:

PUT myindex
{
  "mappings": {
    "properties": {
      "files": {
        "type": "nested" 
      }
    }
  }
}

创建三个文档后:

PUT myindex/_doc/1
{
  "SHA256" : "94ee059335e587e501cc4bf90613e0814f00a7b08bc7c648fd865a2af6a22cc2",
  "files" : [
    {
      "filename" : "firstfilename.exe",
      "datetime" :  111111111
    },
    {
      "filename" : "secondfilename.exe",
      "datetime" :  111111144
    }
  ]
}


PUT myindex/_doc/2
{
  "SHA256" : "87ee059335e587e501cc4bf90613e0814f00a7b08bc7c648fd865a2af6a22c5a",
  "files" : [
    {
      "filename" : "thirdfilename.exe",
      "datetime" :  111111133
    },
    {
      "filename" : "fourthfilename.exe",
      "datetime" :  111111122
    }
  ]
}



PUT myindex/_doc/3
{
  "SHA256" : "565e049335e587e501cc4bf90613e0814f00a7b08bc7c648fd865a2af6a22c5a",
  "files" : [
    {
      "filename" : "fifthfilename.exe",
      "datetime" :  111111155
    }   
  ]
}

如何获取基于日期时间的最后两个文件(标识:1和3)？
我将按DESC排序的最后两个DATETIME中的SHA256。

我做了数十次测试，但都没有顺利进行...
我不写我尝试过的代码，因为我真的在公海...
我会得到这样或类似的结果:

{
 "SHA256": [
             "94ee05933....a2af6a22cc2",
             "565e04933....a2af6a22c5a"
           ]
}

Answer 1

查询:

GET myindex/_search
{
  "_source":"SHA256",
  "sort": [
    {
      "files.datetime": {
        "mode":"max", 
        "order": "desc",
        "nested_path": "files"
      }
    }
  ],
  "size": 2
}

结果:

"hits" : [
      {
        "_index" : "myindex",
        "_type" : "_doc",
        "_id" : "3",
        "_score" : null,
        "_source" : {
          "SHA256" : "565e049335e587e501cc4bf90613e0814f00a7b08bc7c648fd865a2af6a22c5a"
        },
        "sort" : [
          111111155
        ]
      },
      {
        "_index" : "myindex",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : null,
        "_source" : {
          "SHA256" : "94ee059335e587e501cc4bf90613e0814f00a7b08bc7c648fd865a2af6a22cc2"
        },
        "sort" : [
          111111144
        ]
      }
    ]

排序将获得最大日期时间值。因此，如果您也需要获取文件名，则可以将其添加到_source中，并使用sort file获取适当的文件名。

更复杂的查询将为您提供两个确切的值。

GET myindex/_search
{
  "_source": "SHA256",
  "query": {
    "bool": {
      "must": [
        {
          "nested": {
            "path": "files",
            "query": {
              "match_all": {}
            },
            "inner_hits": {
              "size":1,
              "sort": [
                {
                  "files.datetime": "desc"
                }
              ]
            }
          }
        }
      ]
    }
  },
  "sort": [
    {
      "files.datetime": {
        "mode": "max",
        "order": "desc",
        "nested_path": "files"
      }
    }
  ],
  "size": 2
}

结果:

 [
      {
        "_index" : "myindex",
        "_type" : "_doc",
        "_id" : "3",
        "_score" : null,
        "_source" : {
          "SHA256" : "565e049335e587e501cc4bf90613e0814f00a7b08bc7c648fd865a2af6a22c5a"
        },
        "sort" : [
          111111155
        ],
        "inner_hits" : {
          "files" : {
            "hits" : {
              "total" : {
                "value" : 1,
                "relation" : "eq"
              },
              "max_score" : null,
              "hits" : [
                {
                  "_index" : "myindex",
                  "_type" : "_doc",
                  "_id" : "3",
                  "_nested" : {
                    "field" : "files",
                    "offset" : 0
                  },
                  "_score" : null,
                  "_source" : {
                    "filename" : "fifthfilename.exe",
                    "datetime" : 111111155
                  },
                  "sort" : [
                    111111155
                  ]
                }
              ]
            }
          }
        }
      },
      {
        "_index" : "myindex",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : null,
        "_source" : {
          "SHA256" : "94ee059335e587e501cc4bf90613e0814f00a7b08bc7c648fd865a2af6a22cc2"
        },
        "sort" : [
          111111144
        ],
        "inner_hits" : {
          "files" : {
            "hits" : {
              "total" : {
                "value" : 2,
                "relation" : "eq"
              },
              "max_score" : null,
              "hits" : [
                {
                  "_index" : "myindex",
                  "_type" : "_doc",
                  "_id" : "1",
                  "_nested" : {
                    "field" : "files",
                    "offset" : 1
                  },
                  "_score" : null,
                  "_source" : {
                    "filename" : "secondfilename.exe",
                    "datetime" : 111111144
                  },
                  "sort" : [
                    111111144
                  ]
                }
              ]
            }
          }
        }
      }
    ]