我执行此查询
POST /_search {
"query":{
"filtered":{
"filter":{
"bool":{
"must":[
{
"term":{
"tpid":3
}
},
{
"term":{
"eapid":0
}
}
]
}
}
}
}
}
我得到这样的结果
{
"took": 2,
"timed_out": false,
"_shards": {
"total": 20,
"successful": 20,
"failed": 0
},
"hits": {
"total": 10633,
"max_score": 1,
"hits": [
{
"_index": "gss.aggregated.se.logstash-2014.11.04",
"_type": "gss.aggregated.se",
"_id": "v63uksmIRgG9bI5hgS5DIQ",
"_score": 1,
"_source": {
"blacklistAggregatedKey": {
"utcTimestamp": "2014-10-28T09:00",
"departureAirport": "OVB",
"arrivalAirport": "KRR",
"tpid": 3,
"eapid": 0,
"AdvancePurchaseWindow": 3,
"LengthOfStay": -1
},
"blacklistAggregatedValue": {
"searchCount": 1,
"blackListed": 0
},
"@version": "1",
"@timestamp": "2014-11-04T19:30:16.426Z",
"type": "gss.aggregated.se"
}
},
{
"_index": "gss.aggregated.se.logstash-2014.11.04",
"_type": "gss.aggregated.se",
"_id": "bu7I38_CRDG17sXVq3IR-g",
"_score": 1,
"_source": {
"blacklistAggregatedKey": {
"utcTimestamp": "2014-10-28T09:00",
"departureAirport": "OSL",
"arrivalAirport": "OSA",
"tpid": 3,
"eapid": 0,
"AdvancePurchaseWindow": 149,
"LengthOfStay": -1
},
"blacklistAggregatedValue": {
"searchCount": 1,
"blackListed": 0
},
"@version": "1",
"@timestamp": "2014-11-04T19:30:16.486Z",
"type": "gss.aggregated.se"
}
},
{
"_index": "gss.aggregated.se.logstash-2014.11.04",
"_type": "gss.aggregated.se",
"_id": "wWb9xFpuRASTWyaqm-q9Kw",
"_score": 1,
"_source": {
"blacklistAggregatedKey": {
"utcTimestamp": "2014-10-28T09:00",
"departureAirport": "OSL",
"arrivalAirport": "NYC",
"tpid": 3,
"eapid": 0,
"AdvancePurchaseWindow": 49,
"LengthOfStay": -1
},
"blacklistAggregatedValue": {
"searchCount": 1,
"blackListed": 0
},
"@version": "1",
"@timestamp": "2014-11-04T19:30:16.491Z",
"type": "gss.aggregated.se"
}
},
{
"_index": "gss.aggregated.se.logstash-2014.11.04",
"_type": "gss.aggregated.se",
"_id": "c1ULKWyhR0iYmaZ5unafKA",
"_score": 1,
"_source": {
"blacklistAggregatedKey": {
"utcTimestamp": "2014-10-28T09:00",
"departureAirport": "OSL",
"arrivalAirport": "MOW",
"tpid": 3,
"eapid": 0,
"AdvancePurchaseWindow": 16,
"LengthOfStay": -1
},
"blacklistAggregatedValue": {
"searchCount": 1,
"blackListed": 0
},
"@version": "1",
"@timestamp": "2014-11-04T19:30:16.495Z",
"type": "gss.aggregated.se"
}
},
{
"_index": "gss.aggregated.se.logstash-2014.11.04",
"_type": "gss.aggregated.se",
"_id": "BGuGnuXsSne6jB7_ith5Lg",
"_score": 1,
"_source": {
"blacklistAggregatedKey": {
"utcTimestamp": "2014-10-28T09:00",
"departureAirport": "OSL",
"arrivalAirport": "MEL",
"tpid": 3,
"eapid": 0,
"AdvancePurchaseWindow": 10,
"LengthOfStay": -1
},
"blacklistAggregatedValue": {
"searchCount": 2,
"blackListed": 0
},
"@version": "1",
"@timestamp": "2014-11-04T19:30:16.505Z",
"type": "gss.aggregated.se"
}
},
{
"_index": "gss.aggregated.se.logstash-2014.11.04",
"_type": "gss.aggregated.se",
"_id": "lHXm68TTTPG44dIskGCr-w",
"_score": 1,
"_source": {
"blacklistAggregatedKey": {
"utcTimestamp": "2014-10-28T09:00",
"departureAirport": "OSA",
"arrivalAirport": "STO",
"tpid": 3,
"eapid": 0,
"AdvancePurchaseWindow": 12,
"LengthOfStay": -1
},
"blacklistAggregatedValue": {
"searchCount": 1,
"blackListed": 0
},
"@version": "1",
"@timestamp": "2014-11-04T19:30:16.606Z",
"type": "gss.aggregated.se"
}
},
{
"_index": "gss.aggregated.se.logstash-2014.11.04",
"_type": "gss.aggregated.se",
"_id": "DewbkMq0Q22IsReLTRIXww",
"_score": 1,
"_source": {
"blacklistAggregatedKey": {
"utcTimestamp": "2014-10-28T09:00",
"departureAirport": "OSA",
"arrivalAirport": "NYC",
"tpid": 3,
"eapid": 0,
"AdvancePurchaseWindow": 3,
"LengthOfStay": -1
},
"blacklistAggregatedValue": {
"searchCount": 1,
"blackListed": 0
},
"@version": "1",
"@timestamp": "2014-11-04T19:30:16.623Z",
"type": "gss.aggregated.se"
}
},
{
"_index": "gss.aggregated.se.logstash-2014.11.04",
"_type": "gss.aggregated.se",
"_id": "tuCl1rEcT4W3dJ9Am-XvSw",
"_score": 1,
"_source": {
"blacklistAggregatedKey": {
"utcTimestamp": "2014-10-28T09:00",
"departureAirport": "OSA",
"arrivalAirport": "MEL",
"tpid": 3,
"eapid": 0,
"AdvancePurchaseWindow": 9,
"LengthOfStay": 30
},
"blacklistAggregatedValue": {
"searchCount": 25,
"blackListed": 0
},
"@version": "1",
"@timestamp": "2014-11-04T19:30:16.625Z",
"type": "gss.aggregated.se"
}
},
{
"_index": "gss.aggregated.se.logstash-2014.11.04",
"_type": "gss.aggregated.se",
"_id": "6-O9T3HuRYuSVD68_cVeCg",
"_score": 1,
"_source": {
"blacklistAggregatedKey": {
"utcTimestamp": "2014-10-28T09:00",
"departureAirport": "OKC",
"arrivalAirport": "PHX",
"tpid": 3,
"eapid": 0,
"AdvancePurchaseWindow": 126,
"LengthOfStay": 7
},
"blacklistAggregatedValue": {
"searchCount": 1,
"blackListed": 0
},
"@version": "1",
"@timestamp": "2014-11-04T19:30:16.787Z",
"type": "gss.aggregated.se"
}
},
{
"_index": "gss.aggregated.se.logstash-2014.11.04",
"_type": "gss.aggregated.se",
"_id": "5_bGAZxdRIy5kAR5XuV70A",
"_score": 1,
"_source": {
"blacklistAggregatedKey": {
"utcTimestamp": "2014-10-28T09:00",
"departureAirport": "NYC",
"arrivalAirport": "QLA",
"tpid": 3,
"eapid": 0,
"AdvancePurchaseWindow": 11,
"LengthOfStay": -1
},
"blacklistAggregatedValue": {
"searchCount": 1,
"blackListed": 0
},
"@version": "1",
"@timestamp": "2014-11-04T19:30:16.862Z",
"type": "gss.aggregated.se"
}
}
]
}
}
我想在离境机场进一步过滤。当我尝试
时POST /_search
{
"query": {
"filtered": {
"filter": {
"bool": {
"must": [
{
"term": {
"tpid": 3
}
},
{
"term": {
"eapid": 0
}
},
{
"term": {
"departureAirport": "\"OVB\""
}
}
]
}
}
}
}
}
我没有得到结果。
答案 0 :(得分：0)
提到您使用的映射？运行GET _mapping即可。这将有助于调试问题。
但我的预感是，这是一个分析仪问题。必须对字段departureAirport进行分析，以便在索引期间删除其值中的双重引号。这是默认行为。我的意思是，字段departureAirport的索引值为“OVB”（不带引号）而不是“\”OVB \“”（带引号）。这就是为什么你没有得到带引号值的结果。