使用嵌套的子表达式过滤/查询

Question

如何转换

等查询

(((field1:value1 OR
   ((field2: value2a AND field0:value0) OR field2:value2b))
       AND (field3:value3 OR field4:value4)
       OR ((field1:value101 OR field2:value102)
 AND field100:value23)

进入bool查询/过滤器？使用"nested"过滤器似乎不允许任意子表达深度，因为我正在

QueryParsingException[[ptsiem] [nested] filter does not support [should]

Answer 1

我错过了文档中的and和or过滤器：

• http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-and-filter.html
• http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-or-filter.html

这些似乎允许用户构造任何深度的表达式：

{"or": [
    {"and": [
       {"term": {"field1": "w1"}},
       {"term": {"user": "*admin*"}}
    ]},
    {"and": [
        {"term": {"id": "100500" }},
        {"term": {"language": "symta"}},
        {"term": {"oentuh": "bwmbqjk"}}
    ]}
]}