elasticsearch - Elasticsearch-范围查询工作错误

Question

我使用kibana DEV工具查询了一些范围数据，但是有2个匹配项超出我的预期，为什么会发生？

image of the range query

查询:

{
    "query" : {
        "constant_score" : { 
            "filter" : {
                "range" : { 
                    "rss" : {
                      "gte": 3000000
                    }
                }
            }
        }
    }
}

结果:

{
    "took": 1,
    "timed_out": false,
    "_shards": {
        "total": 69,
        "successful": 69,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 2,
        "max_score": 1,
        "hits": [
            {
                "_index": "BBQ",
                "_type": "BBQ",
                "_id": "AWGJaCYkk-tGbWgj2e6R",
                "_score": 1,
                "_source": {
                    "message": [
                        "nodeProcessInfo"
                    ],
                    "@timestamp": "2018-02-12T09:45:59.525Z",
                    "rss": "92636",
                    "@version": "1",
                    "host": "192.168.213.96"
                }
            },
            {
                "_index": "BBQ",
                "_type": "BBQ",
                "_id": "AWGJaJxzk-tGbWgj2e-V",
                "_score": 1,
                "_source": {
                    "message": [
                        "nodeProcessInfo"
                    ],
                    "@timestamp": "2018-02-12T09:46:29.680Z",
                    "rss": "85272",
                    "@version": "1",
                    "host": "192.168.213.96"
                }
            }
        ]
    }
}

范围查询的结果出乎我的意料，为什么gte => 3000000但rss = 92636出现了？

=====================编辑于2018.2.13 =========(1)

像这样的日志:

“nodeProcessInfo | auth-server-1 | auth | 9618 | 1.9 | 1.2 | 98060 | 2018-2-12 6:33:43 PM |”

过滤器是这样的:

filter {
if "nodeProcessInfo" in [message] {  
    mutate {
        split => ["message", "|"]
            add_field => {
                "serverId" => "%{[message[1]]}"
            }
            add_field => {
                "serverType" => "%{[message[2]]}"
            }
            add_field => {
                "pid" => "%{[message[3]]}"
            }
            add_field => {
                "cpuAvg" => "%{[message[4]]}"
            }
            add_field => {
                "memAvg" => "%{[message[5]]}"
            }
            add_field => {
                "rss" => "%{[message[6]]}"
            }
            add_field => {
                "time" => "%{[message[7]]}"
            }
        convert => ["rss", "integer"] # I try convert rss to int, but failed
        add_tag => "nodeProcessInfo"
    }

}

}

======================编辑于2018.2.13 =========(2)

我将转换代码放入一个新的mutate中，它的工作是将“rss”转换为int类型，但范围查询的结果也错误，更改代码如下:

if "nodeProcessInfo" in [message] {  
        mutate {
            split => ["message", "|"]
                ...
                ...
                add_field => {
                    "rss" => "%{[message[6]]}"
                }
        }
        mutate {
            convert => ["rss", "integer"] # add a new mutate here
        }
    }

=====================编辑于2018.2.13 =========(3)

最后，我找到了将rss'type转换为int但range查询也出错的原因:

"You can't change existing mapping type, you need to create a new index with the correct mapping and index the data again."

因此，我创建了一个新的字段名称来代替rss，并且范围查询的结果现在是正确的。

Answer 1

您可以共享索引的映射吗？

我觉得问题是，正如我在共享的搜索结果中看到的那样， rss 字段的类型是文本或字符串。

如果是这样，则您正在使用的范围查询会将它们视为字符串字符，并根据该结果给出结果。

而您要使用的是数字范围，如果您使用rss字段类型为数据建立索引很长然后触发相同的查询，则该数字范围将起作用。

然后，您将获得所需的重用