elasticsearch - 为什么我的ElasticSearch查询不获取任何记录？

Question

我正在运行以下查询:

{
    "size": 50,
    "_source" : ["servername", "silo", "packages.displayname", "packages.displayversion","environment"],

  "query": {
    "bool": {
      "must": {
        "match": {
          "packages.displayname": "Google Chrome"
        }
      }
      ,
       "must": {
        "type": {
          "value": "server"
        }
      }
    }
  }
}

但它不会获取任何记录

{
    "took": 1,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 0,
        "max_score": null,
        "hits": []
    }
}

但是，有关的index \ type有一些记录，其中“packages.displayname” =“Google Chrome”，下面是index \ type的示例

{
    "took": 78,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 994,
        "max_score": 1,
        "hits": [
            {
                "_index": "package_conformity-13.02.2019",
                "_type": "server",
                "_id": "AWjklhaPsoJF1yu58sfg",
                "_score": 1,
                "_source": {
                    "environment": "PRD",
                    "servername": "Zephyr",
                    "packages": [
                        {
                            "displayname": "Google Chrome",
                            "displayversion": "71.0.3578.80"
                        },

这是索引映射:

{
    "package_conformity-13.02.2019": {
        "mappings": {
            "server": {
                "properties": {
                    "environment": {
                        "type": "keyword"
                    },
                    "farm": {
                        "type": "keyword"
                    },
                    "packages": {
                        "type": "nested",
                        "properties": {
                            "InstallDate": {
                                "type": "date",
                                "index": false
                            },
                            "InstallLocation": {
                                "type": "text",
                                "index": false
                            },
                            "comments": {
                                "type": "text",
                                "index": false
                            },
                            "displayname": {
                                "type": "keyword"
                            },
                            "displayversion": {
                                "type": "keyword",
                                "index": false
                            },
                            "publisher": {
                                "type": "text",
                                "index": false
                            },
                            "regkey": {
                                "type": "keyword",
                                "index": false
                            }
                        }
                    },
                    "servername": {
                        "type": "keyword"
                    },
                    "silo": {
                        "type": "keyword"
                    },
                    "timestamp": {
                        "type": "date",
                        "format": "yyyy-MM-dd HH:mm:ss"
                    }
                }
            }
        }
    }
}

查询方式，索引结构或内容有问题吗？请帮我指出正确的方法。

谢谢

Answer 1

如果您的must子句中需要多个约束，则需要有一个数组(不要多次重复must关键字)。同样，应使用_type查询对term进行约束。请尝试以下查询:

{
  "size": 50,
  "_source": [
    "servername",
    "silo",
    "packages.displayname",
    "packages.displayversion",
    "environment"
  ],
  "query": {
    "bool": {
      "must": [
        {
          "nested": {
            "path": "packages",
            "query": {
              "match": {
                "packages.displayname": "Google Chrome"
              }
            }
          }
        },
        {
          "term": {
            "_type": "server"
          }
        }
      ]
    }
  }
}