Question

使用大写字符搜索而不返回弹性搜索前缀查询中的结果。我没有在映射中定义任何分析器，并假设弹性搜索将使用默认映射进行索引和搜索。

{
  "access-event-logs_2016-02-08t00:00:00-08:00": {
    "mappings": {
      "session-summary": {
        "dynamic_templates": [
          {
            "long_1": {
              "mapping": {
                "type": "long"
              },
              "match": "generation"
            }
          },
          {
            "datetime_1": {
              "mapping": {
                "format": "strict_date_optional_time||epoch_millis",
                "type": "date"
              },
              "match": "*DateTime"
            }
          },
          {
            "string_1": {
              "mapping": {
                "index": "not_analyzed",
                "type": "string"
              },
              "match": "*"
            }
          }
        ],
        "properties": {
          "Access_Policy_Result": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Bytes_In": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Bytes_Out": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Client_IP": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Client_Platform": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Continent": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Country": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Partition": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Reputation": {
            "type": "string",
            "index": "not_analyzed"
          },
          "State": {
            "type": "string",
            "index": "not_analyzed"
          },
          "User_Name": {
            "type": "string",
            "index": "not_analyzed"
          },
          "Virtual_IP": {
            "type": "string",
            "index": "not_analyzed"
          },
          "accessProfile": {
            "type": "string",
            "index": "not_analyzed"
          },
          "active": {
            "type": "string",
            "index": "not_analyzed"
          },
          "badIpReputation": {
            "type": "string",
            "index": "not_analyzed"
          },
          "clusterName": {
            "type": "string",
            "index": "not_analyzed"
          },
          "duration": {
            "type": "string",
            "index": "not_analyzed"
          },
          "eventConversionDateTime": {
            "type": "date",
            "format": "strict_date_optional_time||epoch_millis"
          },
          "generation": {
            "type": "long"
          },
          "hostname": {
            "type": "string",
            "index": "not_analyzed"
          },
          "lastUpdateMicros": {
            "type": "string",
            "index": "not_analyzed"
          },
          "sessionDuration": {
            "type": "string",
            "index": "not_analyzed"
          },
          "sessionKey": {
            "type": "string",
            "index": "not_analyzed",
            "include_in_all": false
          },
          "sessionTerminationDateTime": {
            "type": "date",
            "format": "strict_date_optional_time||epoch_millis"
          },
          "session_id": {
            "type": "string",
            "index": "not_analyzed"
          },
          "unique_id": {
            "type": "string",
            "index": "not_analyzed",
            "include_in_all": false
          },
          "virtualServer": {
            "type": "string",
            "index": "not_analyzed"
          }
        }
      }
    }
  }
}

此查询返回结果，但如果我使用Common而不是（common）搜索，没有返回任何结果。我是否需要指定任何分析器来执行不区分大小写的搜索

{
      "query":{  
         "filtered":{  
            "filter":{  
               "bool":{  
                  "must":[  
                     {  
                        "range":{  
                           "eventConversionDateTime":{  
                              "gte":"2015-10-30T02:50:39.237Z",
                              "lte":"2015-12-31T02:50:38.237Z"
                           }
                        }
                     }
                       {  
                        "prefix":{  
                               "_all":"common"

                        }
                     }
                  ]
               }
            }
         }
      }

Answer 1

查看您的文档，iirc ES会在索引文档时降低案例。同时使用匹配查询将处理匹配所需的箍。

Answer 2

参考ES文档，它清楚地说： “匹配包含具有指定前缀（未分析）的术语的字段的文档。前缀查询映射到Lucene PrefixQuery。”

前缀查询是未分析的搜索查询。

Answer 3

解决问题的最佳方法。以小写形式索引所有文档，并以小写形式传递搜索文本。与弹性搜索一样，搜索文本区分大小写。如果您不想执行上述步骤，可以为索引设置自定义分析器，这将生成小写的所有术语。请参阅以下文件 https://www.elastic.co/guide/en/elasticsearch/reference/2.2/analysis-lowercase-tokenfilter.html

弹性搜索分析器

3 个答案: