Question

我想抓取所有文件loId=6 AND (actionType = "SAVE_DATA" 或 actionType = "OPEN_SCREEN")。

我是否错误地写了这个逻辑？

为什么我的查询返回0结果？

注意：我接受查询或过滤器来解决此问题。

以下是一些示例文档：

 {
    "_index": "logs",
    "_type": "record",
    "_id": "eIIt3vtrSxmdOVGClQmN3w",
    "_score": 1,
    "_source": {
       "timestamp": 1373569919000,
       "uid": 6,
       "paId": 56298,
       "loId": 6,
       "prId": 2,
       "vId": 6577,
       "actionType": "SAVE_DATA"
    }
 },
 {
    "_index": "logs",
    "_type": "record",
    "_id": "yQGCia6qRYCImZLyH7DrEA",
    "_score": 1,
    "_source": {
       "timestamp": 1373570314000,
       "uid": 6,
       "paId": 56641,
       "loId": 6,
       "prId": 2,
       "vId": 6578,
       "actionType": "CHECK_IN"
    }
 },
 {
    "_index": "logs",
    "_type": "record",
    "_id": "2raajrNKTKeRKG88wiNPpw",
    "_score": 1,
    "_source": {
       "timestamp": 1373570532000,
       "uid": 6,
       "paId": 56641,
       "loId": 6,
       "prId": 2,
       "vId": 6579,
       "actionType": "LOAD_DATA"
    }
 },
 {
    "_index": "logs",
    "_type": "record",
    "_id": "0FDBxW2ESl6tfmj81YJvIg",
    "_score": 1,
    "_source": {
       "timestamp": 1373570761000,
       "uid": 6,
       "paId": 56298,
       "loId": 6,
       "prId": 2,
       "vId": 6577,
       "actionType": "OPEN_SCREEN"
    }
 },
 {
    "_index": "logs",
    "_type": "record",
    "_id": "-bFQyEdCQVWiXNldtxz04g",
    "_score": 1,
    "_source": {
       "timestamp": 1373570777000,
       "uid": 6,
       "paId": 56298,
       "loId": 6,
       "prId": 2,
       "vId": 6577,
       "actionType": "OPEN_SCREEN"
    }
 }

查询

{
   "query": {
      "filtered": {
          "query": {
              "term": {
                    "loId": 6
              }
          }, 
         "filter": {
            "or": {
               "filters": [
                  {
                     "term": {
                        "actionType": "SAVE_DATA"
                     }
                  },
                  {
                     "term": {
                        "actionType": "OPEN_SCREEN"
                     }
                  }
               ],
               "_cache": false
            }
         }
      }
   }
}

Answer 1

您在获取结果时遇到问题的主要原因是您尝试在term上进行actionType过滤，这是一个已分析的字段。如果您想在该字段上进行term匹配，则需要更新类型映射以将该字段设置为not_analyzed。请参阅此示例映射：

{
   "record": {
      "properties": {
         "actionType": {
            "type": "string",
            "index": "not_analyzed",
         },
         "loId": {
            "type": "long"
         },
         "paId": {
            "type": "long"
         },
         "prId": {
            "type": "long"
         },
         "timestamp": {
            "type": "long"
         },
         "uid": {
            "type": "long"
         },
         "vId": {
            "type": "long"
         }
      }
   }
}

从这里开始阅读映射：http://www.elasticsearch.org/guide/reference/mapping/。您需要重新编制数据索引。修复后，这是一个可行的查询：

{ 
    "query": { 
        "filtered": {
           "query": {"match_all":{}},
           "filter": {
               "bool": {
                   "must": [
                       {"term": {"loId":6}},
                       {
                           "or": [
                               {"term":{"actionType": "SAVE_DATA"}},
                               {"term":{"actionType": "OPEN_SCREEN"}}
                           ]
                       }
                   ]
               }
           }
        }
    }
}

如何在elasticsearch中正确编写布尔值或逻辑？

1 个答案: