我的索引中有一个字段包含一个字符串数据..我在预期文件下面运行dsl查询哪个类别字段不等于“ - ”字符..但是当你看到pic它返回.. 检索这些数据的方法是什么?
GET webproxylog/_search
{
"query": {
"filtered": {
"query": {"match_all": {}},
"filter": {
"not": {
"filter": {
"term": {
"category": "-"
}
}
}
}
}
}
}
映射:
{
"webproxylog": {
"mappings": {
"accesslog": {
"properties": {
"category": {
"type": "string"
},
"clientip": {
"type": "string",
"index": "not_analyzed"
},
"clientmac": {
"type": "string",
"index": "not_analyzed"
},
"clientname": {
"type": "string"
},
"duration": {
"type": "long"
},
"filetype": {
"type": "string",
"index": "not_analyzed"
},
"hierarchycode": {
"type": "string",
"index": "not_analyzed"
},
"loggingdate": {
"type": "date",
"format": "dateOptionalTime"
},
"reqmethod": {
"type": "string",
"index": "not_analyzed"
},
"respsize": {
"type": "long"
},
"resultcode": {
"type": "string",
"index": "not_analyzed"
},
"url": {
"type": "string",
"index": "not_analyzed"
},
"user": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}
}
答案 0 :(得分:1)
我对ES 1.7.1的测试:
{
"settings": {
"number_of_shards": 1,
"number_of_replicas": 0
},
"mappings": {
"user": {
"properties": {
"number": { "type": "integer" },
"name": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}
文档:
{"number":1, "name":"abc"}
{"number":2, "name":"-"}
查询:
{
"size": 2,
"query": {
"filtered": {
"filter": {
"not": {
"term": {
"name": "-"
}
}
}
}
}
}
结果:
{
took: 1
timed_out: false
_shards: {
total: 1
successful: 1
failed: 0
}
hits: {
total: 1
max_score: 1
hits: [
{
_index: test_index
_type: user
_id: AVAiYtEjMfj2vcjSSqVr
_score: 1
_source: {
number: 1
name: abc
}
}
]
}
}
没有"index": "not_analyzed"
我看到了报告的行为,我没有检查“ - ”在这种情况下如何被标记化(忘记了查询:P)