Question

以下是我存储在ES中的示例记录：

  "taskCurateStatus": true,
  "taskMigrateStatus": true,
  "verifiedFields": 7,
  "taskId": "abcdef123",
  "operatorEmail": "test@test.com"

Example Query I'm making via /_search:
{
  "sort": [
    {
      "@timestamp": {
        "order": "desc"
      }
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "msg.operator_email": "test@test.com"
          }
        }
        {
          "range": {
            "@timestamp": {
              "gte": "2017-03-05",
              "lte": "2017-03-12"
            }
          }
        }
      ]
    }
  },
  "from": 0,
  "size": 50
}

基本上我还要根据EITHER taskCurateStatus或taskMigrateStatus为真的文档进行过滤。某些消息只定义了其中一个消息。我在考虑使用should查询但不确定如何使用match查询。任何帮助，将不胜感激。感谢

Answer 1

你可以在必须过滤器中添加另一个布尔过滤器。这个布尔过滤器可以实现should子句，你可以将布尔标志与结合两个布尔检查过滤器的过滤器进行比较

{
    "sort": [{
        "@timestamp": {
            "order": "desc"
        }
    }],
    "query": {
        "bool": {
            "must": [{
                "match": {
                    "msg.operator_email": "test@test.com"
                }
            }, {
                "range": {
                    "@timestamp": {
                        "gte": "2017-03-05",
                        "lte": "2017-03-12"
                    }
                }
            }, {
                "bool": {
                    "should": [{
                        "term": {
                            "taskCurateStatus": {
                                "value": true
                            }
                        }
                    }, {
                        "term": {
                            "taskMigrateStatus": {
                                "value": true
                            }
                        }
                    }]
                }
            }]
        }
    },
    "from": 0,
    "size": 50
}

看一下上面的查询，看看是否有帮助感谢

Elasticsearch多个字段或查询

1 个答案: