ElasticSearch:查询帖子正文不起作用但uri搜索工作

Question

我正在发送以下 Elasticsearch 查询，它在通过 uri-search 发送时表现得非常好。但是对于带有 body 调用的帖子 - 它无法按预期工作。请建议如何更正查询。

这有效:

接听电话

<someUrl>/elasticsearch/index/_search?q=host:host-0

响应(仅限于 host-0)

{
    "took": 4,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "failed": 0
    },
    "hits": {
        "total": 128040,
        "max_score": 2.0973763,
        "hits": [{
                "_index": "123"
                "_type": "log_message",
                "_id": "123",
                "_score": 111,
                "_source": {
                    "host": "host-0",
                    "pid": 333,
                    "timestamp": "2017-04-06T04:29:44.724Z",
                    "priority": 7,
                    "namespace": "syslog",
                    "msg": "aaaaa"
                }
            },

            "_index": "345"
            "_type": "log_message",
            "_id": "345",
            "_score": 111,
            "_source": {
                "host": "host-0",
                "pid": 333,
                "timestamp": "2017-04-06T04:29:44.724Z",
                "priority": 7,
                "namespace": "syslog",
                "msg": "aaaaa"
            }
        }, 
        .....
}

这不起作用:

邮寄电话

<someUrl>/elasticsearch/index/_search

POST 调用的主体:

{
    "query" : {
        "term" : { "host": "host-0" }
    }
}

RESPONSE(不限于 host-0)

{
    "took": 4,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "failed": 0
    },
    "hits": {
        "total": 128040,
        "max_score": 2.0973763,
        "hits": [{
                "_index": "123"
                "_type": "log_message",
                "_id": "123",
                "_score": 111,
                "_source": {
                    "host": "host-1",
                    "pid": 333,
                    "timestamp": "2017-04-06T04:29:44.724Z",
                    "priority": 7,
                    "namespace": "syslog",
                    "msg": "aaaaa"
                }
            },

            "_index": "345"
            "_type": "log_message",
            "_id": "345",
            "_score": 111,
            "_source": {
                "host": "host-0",
                "pid": 333,
                "priority": 7,
                "namespace": "syslog",
                "msg": "aaaaa"
            }
        }, 
            "_index": "546"
            "_type": "log_message",
            "_id": "546",
            "_score": 111,
            "_source": {
                "host": "host-0",
                "pid": 222,                 
                "priority": 7,
                "namespace": "syslog",
                "msg": "aaaaa"
            }
        }, 
        .....
}

该索引上的 Get 返回
获取/ Elasticsearch /

      "host": {
        "type": "string", 
        "index": "not_analyzed"
      },

Answer 1

在您的 GET 调用中， token host-0被分析。如果您尝试以下 GET 调用(通过将 host-0 括在双引号中)，您将获得与 POST 调用相同的查询，但不会得到任何结果。

<someUrl>/elasticsearch/index/_search?q=host:"host-0"

如果你想要结果，你需要使用 match查询而不是 term一。这将相当于 ...?q=host:host-0在你的 GET 电话中。

{
    "query" : {
        "match" : { "host": "host-0" }
    }
}

最后我认为你的 host字段有 text输入，而它应该有 keyword类型。