弹性搜索中的嵌套查询

Question

我在这种形式的弹性搜索中有一个模式：

{
   "index1" : {
      "mappings" : {
         "properties" : {
            "key1" : {
               "type" : "keyword"
            },
            "key2" : {
               "type" : "keyword"
            },
            "key3" : {
               "properties" : {
                  "components" : {
                     "type" : "nested",
                     "properties" : {
                        "sub1" : {
                           "type" : "keyword"
                        },
                        "sub2" : {
                           "type" : "keyword"
                        },
                        "sub3" : {
                           "type" : "keyword"
                        }
                     }
                  }
               }
            }
         }
      }
   }
}

，那么弹性搜索中存储的数据将采用以下格式：

{
   "_index" : "index1",
   "_type" : "_doc",
   "_id" : "1",
   "_score" : 1.0,
   "_source" : {
      "key1" : "val1",
      "key2" : "val2",
      "key3" : {
         components : [
            {
               "sub1" : "subval11",
               "sub3" : "subval13"
            },
            {
               "sub1" : "subval21",
               "sub2" : "subval22",
               "sub3" : "subval23"
            },
            {
               "sub1" : "subval31",
               "sub2" : "subval32",
               "sub3" : "subval33"
            }
         ]
      }
   }
}

您会发现key1，sub2和sub3可能不会出现在key3下的几个对象中。

现在，如果我尝试编写查询以使用此查询基于 key3.sub2 作为 subval22 来获取结果

GET index1/_search
{
  "query": {
    "nested": {
      "path": "components",
      "query": {
        "bool": {
          "must": [
            {
              "match": {"key3.sub2": "subval22"}
            }
          ]
        }
      }
    }
  }
}

我总是得到

的错误

{
  "error": {
    "root_cause": [
      {
        "type": "query_shard_exception",
        "reason": "failed to create query: {...}",
        "index_uuid": "1",
        "index": "index1"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "index1",
        "node": "1aK..",
        "reason": {
          "type": "query_shard_exception",
          "reason": "failed to create query: {...}",
          "index_uuid": "1",
          "index": "index1",
          "caused_by": {
            "type": "illegal_state_exception",
            "reason": "[nested] failed to find nested object under path [components]"
          }
        }
      }
    ]
  },
  "status": 400
}

我知道，由于 sub2 并不存在于组件下的所有对象中，因此会引发此错误。我正在寻找一种方法来搜索这种情况，使其匹配并找到数组中的所有对象。如果值匹配，则应返回此文档。

有人可以帮助我完成这项工作吗？

Answer 1

在定义架构时出错，在架构下方可以正常工作，请注意我刚刚将key3定义为嵌套的。并将嵌套路径更改为key3

索引定义

{
    "mappings": {
        "properties": {
            "key1": {
                "type": "keyword"
            },
            "key2": {
                "type": "keyword"
            },
            "key3": {
                "type": "nested"
            }
        }
    }
}

您采样文档的索引没有任何变化

 {
  "key1": "val1",
  "key2": "val2",
  "key3": {
    "components": [ --> this was a diff
      {
        "sub1": "subval11",
        "sub3": "subval13"
      },
      {
        "sub1": "subval21",
        "sub2": "subval22",
        "sub3": "subval23"
      },
      {
        "sub1": "subval31",
        "sub2": "subval32",
        "sub3": "subval33"
      }
    ]
  }
}

根据您的条件进行搜索

 {
    "query": {
        "nested": {
            "path": "key3", --> note this
            "query": {
                "bool": {
                    "must": [
                        {
                            "match": {
                                "key3.components.sub2": "subval22" --> note this
                            }
                        }
                    ]
                }
            }
        }
    }
}

这会带来正确的搜索结果

   "hits": [
      {
        "_index": "so_nested_61200509",
        "_type": "_doc",
        "_id": "2",
        "_score": 0.2876821,
        "_source": {
          "key1": "val1",
          "key2": "val2",
          "key3": {
            "components": [ --> note this
              {
                "sub1": "subval11",
                "sub3": "subval13"
              },
              {
                "sub1": "subval21",
                "sub2": "subval22",
                "sub3": "subval23"
              },
              {
                "sub1": "subval31",
                "sub2": "subval32",
                "sub3": "subval33"
              }
            ]

编辑：-基于OP中的注释，更新的示例文档，搜索查询和结果。