Question

我有一大堆由Elasticsearch索引的文件。除了其他信息，我还从这些文件中提取了所有ASCII字符串。字符串的映射：

 ...
 "strings": {
            "type": "string",
            "index" : "not_analyzed"
 },
 ...

此服务是公开的，因此任何人都可以搜索特定的字符串，ES应该返回包含该字符串的所有文件。假设一个文件包含以下字符串：

 Library/Application Support/MyApp/Users/Default/Logs

问题是当我搜索包含这种字符串的文件时。

我尝试使用以下查询，但它引发了 search_phase_execution_exception ：

 strings:*Support\\/MyApp*

我该如何搜索？

我正在使用elasticsearch-py（http://elasticsearch-py.readthedocs.io/en/master/）连接到ES。查询看起来像这样

query_body = {
            "query": {
                      "query_string": {
                                       "query": "%s" % to_search
                      }
            }
}
data = es.search(index="files",
                       body=query_body)

，其中 to_search 是POST参数的值。

django错误：

RequestError at /search/
TransportError(400, u'search_phase_execution_exception')
Request Method: GET
Request URL:    http://----------/search/data=strings%3A*Support%5C%5C%2FMyApp*
Django Version: 1.8.5
Exception Type: RequestError
Exception Value:    
TransportError(400, u'search_phase_execution_exception')
Exception Location: C:\Python27\lib\site-packages\elasticsearch\connection\base.py in _raise_error, line 105

此外，ES错误：

RemoteTransportException[[Strong Guy][192.168.71.14:9300 [indices:data/read/search[phase/query]]]; nested: SearchParseException[failed to parse search source [{"query": {"query_string": {"query": "strings:*Support\\\\/MyApp*"}}, "from": 0, "size": 18}]]; nested: QueryParsingException[Failed to parse query [strings:*Support\\/MyApp*]]; nested: ParseException[Cannot parse 'strings:*Support\\/MyApp*': Lexical error at line 1, column 26.

Encountered: <EOF> after : "/MyApp*"]; nested: TokenMgrError[Lexical error at line 1, column 26.  Encountered: <EOF> after : "/MyApp*"];
Caused by: SearchParseException[failed to parse search source [{"query": {"query_string": {"query": "strings:*Support\\\\/MyApp*"}}, "from": 0, "size": 18}]]; nested: QueryParsingException[Failed to parse query [strings
:*Support\\/MyApp*]]; nested: ParseException[Cannot parse 'strings:*Support\\/MyApp*': Lexical error at line 1, column 26.  Encountered: <EOF> after : "/MyApp*"]; nested: TokenMgrError[Lexical error at line 1, column 26
.  Encountered: <EOF> after : "/MyApp*"];

Answer 1

您可以尝试发布此查询，我会通过添加lowercase_expanded_terms并将其设置为false来获得结果

{
  "query": {
    "query_string": {
      "query": "strings:/.*Support\\/MyApp.*/",
      "lowercase_expanded_terms": false
    }
  }
}

您原来的也可以使用

{
  "query": {
    "query_string": {
      "query": "strings:*Support\\/MyApp*",
      "lowercase_expanded_terms": false
    }
  }
}

Elasticsearch正斜杠查询字符串

1 个答案: