基于1个术语值查询嵌套JSON

时间:2017-04-24 10:41:28

标签: elasticsearch kibana

我已将JSON编入索引,如下格式

JSON:

{"work":[{"organization":"abc", end:"present"},{"organization":"edf", end:"old"}]}
{"work":[{"organization":"edf", end:"present"},{"organization":"abc", end:"old"}]}

我想查询组织所在的记录" abc"结束是"现在"

但查询下方无效

 work.0.organization: "abc" AND work.0.end:"present"

没有匹配的记录

如果我提供如下查询

 work.organization: "abc" AND work.end:"present"

两个记录都匹配。而只有第一条记录才是我想要的

匹配的记录应仅为以下

{"work":[{"organization":"abc", end:"present"},{"organization":"edf", end:"old"}]}

1 个答案:

答案 0 :(得分:1)

您必须使用nested_types。第一个映射使用以下映射作为弹性嵌套类型

PUT index_name_3
{
  "mappings": {
    "document_type" : {
      "properties": {
        "work" : {
          "type": "nested",
          "properties": {
            "organization" : {
              "type" : "text"
            },
            "end" : {
              "type" : "text"
            }
          }
        }
      }
    }
  }
}

使用以下查询执行嵌套过滤器匹配和innerhits

{
    "query": {
        "nested": {
            "path": "work",
            "inner_hits": {},
            "query": {
                "bool": {
                    "must": [{
                            "term": {
                                "work.organization": {
                                    "value": "abc"
                                }
                            }
                        },
                        {
                            "term": {
                                "work.end": {
                                    "value": "present"
                                }
                            }
                        }
                    ]
                }
            }
        }
    }
}