在elasticsearch中不等于查询

时间:2015-10-01 07:25:46

标签: elasticsearch

我的索引中有一个字段包含一个字符串数据..我在预期文件下面运行dsl查询哪个类别字段不等于“ - ”字符..但是当你看到pic它返回.. 检索这些数据的方法是什么?

GET webproxylog/_search
{
  "query": {
    "filtered": {
      "query": {"match_all": {}},
      "filter": {
        "not": {
          "filter": {
            "term": {
              "category": "-"
            }
          }
        }
      }
    }
  }
}

enter image description here

映射:

{
   "webproxylog": {
      "mappings": {
         "accesslog": {
            "properties": {
               "category": {
                  "type": "string"
               },
               "clientip": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "clientmac": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "clientname": {
                  "type": "string"
               },
               "duration": {
                  "type": "long"
               },
               "filetype": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "hierarchycode": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "loggingdate": {
                  "type": "date",
                  "format": "dateOptionalTime"
               },
               "reqmethod": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "respsize": {
                  "type": "long"
               },
               "resultcode": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "url": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "user": {
                  "type": "string",
                  "index": "not_analyzed"
               }
            }
         }
      }
   }
}

1 个答案:

答案 0 :(得分:1)

我对ES 1.7.1的测试:

{
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 0
  },
  "mappings": {
    "user": {
      "properties": {
        "number": { "type": "integer" },
        "name": {
          "type": "string",
          "index": "not_analyzed"
        }
      }
    }
  }
}

文档:

{"number":1, "name":"abc"}
{"number":2, "name":"-"}

查询:

{
  "size": 2,
  "query": {
    "filtered": {
      "filter": {
        "not": {
          "term": {
            "name": "-"
          }
        }
      }
    }
  }
}

结果:

{
    took: 1
    timed_out: false
    _shards: {
        total: 1
        successful: 1
        failed: 0
    }
    hits: {
        total: 1
        max_score: 1
        hits: [
            {
                _index: test_index
                _type: user
                _id: AVAiYtEjMfj2vcjSSqVr
                _score: 1
                _source: {
                    number: 1
                    name: abc
                }
            }
        ]
    }
}

没有"index": "not_analyzed"我看到了报告的行为,我没有检查“ - ”在这种情况下如何被标记化(忘记了查询:P)