检查字段是否存在以及另一个字段是否匹配Elasticsearch文档中的字符串的最佳方法?

时间:2017-04-24 19:15:40

标签: elasticsearch

#First Document  
    { "fullname":"John", "age":70, "car":{"model":{"nickname":"nevan"}}}
#Second Document

{ "fullname":"Bala", "age":30, "car":{"model":{"nickname":"jessica"}}}

#Third Document

{ "fullname":"Bala", "age":25, "car":{"model":{"nickname":"hilica"}}}

#Fourth Document

{ "fullname":"Bala", "age":30 }

1.查询应该是返回具有字段car.model.nickname的文档,fullname是“Bala”。 2.Answer应该是第二和第三个文件。

我尝试了以下一个匹配或术语但没有用的

GET index-bala/_search
{
    "query" : {
        "bool": {
            "must" : [
                { "exists": { "field": "car.model.nickname" } },
                { "term" : { "fullname": "bala"} }

            ]
        }
    }
}

我试图找到解决方案而不会使问题变得复杂。 这是真实的例子。 查询要求是字段“content.system.cpu”存在且主机名值等于“balahost1.com”

类似于公制节拍映射:

{
   "index-bala": {
      "mappings": {
         "type-bala": {
            "properties": {
               "@timestamp": {
                  "type": "date",
                  "format": "strict_date_optional_time||epoch_millis"
               },
               "content": {
                  "properties": {
                     "@timestamp": {
                        "type": "date",
                        "format": "strict_date_optional_time||epoch_millis"
                     },
                     "@version": {
                        "type": "string"
                     },
                     "beat": {
                        "properties": {
                           "hostname": {
                              "type": "string"
                           },
                           "name": {
                              "type": "string"
                           },
                           "version": {
                              "type": "string"
                           }
                        }
                     },
                     "host": {
                        "type": "string"
                     },
                     "metricset": {
                        "properties": {
                           "module": {
                              "type": "string"
                           },
                           "name": {
                              "type": "string"
                           },
                           "rtt": {
                              "type": "long"
                           }
                        }
                     },
                     "system": {
                        "properties": {
                           "cpu": {
                              "properties": {
                                 "cores": {
                                    "type": "long"
                                 },
                                 "idle": {
                                    "properties": {
                                       "pct": {
                                          "type": "double"
                                       }
                                    }
                                 },
                                 "iowait": {
                                    "properties": {
                                       "pct": {
                                          "type": "double"
                                       }
                                    }
                                 },
                                 "irq": {
                                    "properties": {
                                       "pct": {
                                          "type": "long"
                                       }
                                    }
                                 },
                                 "nice": {
                                    "properties": {
                                       "pct": {
                                          "type": "long"
                                       }
                                    }
                                 },
                                 "softirq": {
                                    "properties": {
                                       "pct": {
                                          "type": "double"
                                       }
                                    }
                                 },
                                 "steal": {
                                    "properties": {
                                       "pct": {
                                          "type": "long"
                                       }
                                    }
                                 },
                                 "system": {
                                    "properties": {
                                       "pct": {
                                          "type": "double"
                                       }
                                    }
                                 },
                                 "user": {
                                    "properties": {
                                       "pct": {
                                          "type": "double"
                                       }
                                    }
                                 }
                              }
                           },
                           "filesystem": {
                              "properties": {
                                 "available": {
                                    "type": "long"
                                 },
                                 "device_name": {
                                    "type": "string"
                                 },
                                 "files": {
                                    "type": "long"
                                 },
                                 "free": {
                                    "type": "long"
                                 },
                                 "free_files": {
                                    "type": "long"
                                 },
                                 "mount_point": {
                                    "type": "string"
                                 },
                                 "total": {
                                    "type": "long"
                                 },
                                 "used": {
                                    "properties": {
                                       "bytes": {
                                          "type": "long"
                                       },
                                       "pct": {
                                          "type": "long"
                                       }
                                    }
                                 }
                              }
                           },
                           "memory": {
                              "properties": {
                                 "actual": {
                                    "properties": {
                                       "free": {
                                          "type": "long"
                                       },
                                       "used": {
                                          "properties": {
                                             "bytes": {
                                                "type": "long"
                                             },
                                             "pct": {
                                                "type": "double"
                                             }
                                          }
                                       }
                                    }
                                 },
                                 "free": {
                                    "type": "long"
                                 },
                                 "swap": {
                                    "properties": {
                                       "free": {
                                          "type": "long"
                                       },
                                       "total": {
                                          "type": "long"
                                       },
                                       "used": {
                                          "properties": {
                                             "bytes": {
                                                "type": "long"
                                             },
                                             "pct": {
                                                "type": "double"
                                             }
                                          }
                                       }
                                    }
                                 },
                                 "total": {
                                    "type": "long"
                                 },
                                 "used": {
                                    "properties": {
                                       "bytes": {
                                          "type": "long"
                                       },
                                       "pct": {
                                          "type": "double"
                                       }
                                    }
                                 }
                              }
                           },
                           "process": {
                              "properties": {
                                 "cmdline": {
                                    "type": "string"
                                 },
                                 "cpu": {
                                    "properties": {
                                       "start_time": {
                                          "type": "date",
                                          "format": "strict_date_optional_time||epoch_millis"
                                       },
                                       "total": {
                                          "properties": {
                                             "pct": {
                                                "type": "long"
                                             }
                                          }
                                       }
                                    }
                                 },
                                 "fd": {
                                    "properties": {
                                       "limit": {
                                          "properties": {
                                             "hard": {
                                                "type": "long"
                                             },
                                             "soft": {
                                                "type": "long"
                                             }
                                          }
                                       },
                                       "open": {
                                          "type": "long"
                                       }
                                    }
                                 },
                                 "memory": {
                                    "properties": {
                                       "rss": {
                                          "properties": {
                                             "bytes": {
                                                "type": "long"
                                             },
                                             "pct": {
                                                "type": "long"
                                             }
                                          }
                                       },
                                       "share": {
                                          "type": "long"
                                       },
                                       "size": {
                                          "type": "long"
                                       }
                                    }
                                 },
                                 "name": {
                                    "type": "string"
                                 },
                                 "pgid": {
                                    "type": "long"
                                 },
                                 "pid": {
                                    "type": "long"
                                 },
                                 "ppid": {
                                    "type": "long"
                                 },
                                 "state": {
                                    "type": "string"
                                 },
                                 "username": {
                                    "type": "string"
                                 }
                              }
                           }
                        }
                     },
                     "tags": {
                        "type": "string"
                     },
                     "type": {
                        "type": "string"
                     }
                  }
               },
               "hostname": {
                  "type": "string"
               },
               "service": {
                  "type": "string"
               }
            }
         }
      }
   }
}

示例数据:

数据1:

{
    "@timestamp": "2017-04-25T10:13:35.536Z",
    "content": {
      "metricset": {
        "name": "memory",
        "rtt": 173,
        "module": "system"
      },
      "beat": {
        "version": "5.2.2",
        "name": "balahost1.com",
        "hostname": "balahost1.com"
      },
      "@timestamp": "2017-04-25T10:13:33.180Z",
      "type": "metricsets",
      "system": {
        "memory": {
          "used": {
            "bytes": 3219914752,
            "pct": 0.8117
          },
          "free": 747134976,
          "actual": {
            "free": 1879838720,
            "used": {
              "pct": 0.5261,
              "bytes": 2087211008
            }
          },
          "swap": {
            "used": {
              "bytes": 200433664,
              "pct": 0.0482
            },
            "free": 3960311808,
            "total": 4160745472
          },
          "total": 3967049728
        }
      },
      "@version": "1",
      "host": "balahost1.com",
      "tags": [
        "beats_input_raw_event"
      ]
    },
    "hostname": "balahost1.com",
    "service": "index-bala"
  }

数据2

{
    "@timestamp": "2017-04-25T10:13:35.532Z",
    "content": {
      "@timestamp": "2017-04-25T10:13:33.179Z",
      "type": "metricsets",
      "system": {
        "cpu": {
          "nice": {
            "pct": 0.0001
          },
          "system": {
            "pct": 0.0121
          },
          "iowait": {
            "pct": 0.0012
          },
          "irq": {
            "pct": 0
          },
          "steal": {
            "pct": 0
          },
          "softirq": {
            "pct": 0.0002
          },
          "cores": 2,
          "user": {
            "pct": 0.0189
          },
          "idle": {
            "pct": 0.9675
          }
        }
      },
      "metricset": {
        "module": "system",
        "name": "cpu",
        "rtt": 201
      },
      "beat": {
        "name": "balahost1.com",
        "hostname": "balahost1.com",
        "version": "5.2.2"
      },
      "@version": "1",
      "host": "balahost1.com",
      "tags": [
        "beats_input_raw_event"
      ]
    },
    "hostname": "balahost1.com",
    "service": "index-bala"
  }

数据3:

{
    "@timestamp": "2017-04-25T10:13:35.536Z",
    "content": {
      "metricset": {
        "name": "memory",
        "rtt": 173,
        "module": "system"
      },
      "beat": {
        "version": "5.2.2",
        "name": "balahost2.com",
        "hostname": "balahost2.com"
      },
      "@timestamp": "2017-04-25T10:13:33.180Z",
      "type": "metricsets",
      "system": {
        "memory": {
          "used": {
            "bytes": 3219914752,
            "pct": 0.8117
          },
          "free": 747134976,
          "actual": {
            "free": 1879838720,
            "used": {
              "pct": 0.5261,
              "bytes": 2087211008
            }
          },
          "swap": {
            "used": {
              "bytes": 200433664,
              "pct": 0.0482
            },
            "free": 3960311808,
            "total": 4160745472
          },
          "total": 3967049728
        }
      },
      "@version": "1",
      "host": "balahost2.com",
      "tags": [
        "beats_input_raw_event"
      ]
    },
    "hostname": "balahost2.com",
    "service": "index-bala"
  }

数据4

{
    "@timestamp": "2017-04-25T10:13:35.532Z",
    "content": {
      "@timestamp": "2017-04-25T10:13:33.179Z",
      "type": "metricsets",
      "system": {
        "cpu": {
          "nice": {
            "pct": 0.0001
          },
          "system": {
            "pct": 0.0121
          },
          "iowait": {
            "pct": 0.0012
          },
          "irq": {
            "pct": 0
          },
          "steal": {
            "pct": 0
          },
          "softirq": {
            "pct": 0.0002
          },
          "cores": 2,
          "user": {
            "pct": 0.0189
          },
          "idle": {
            "pct": 0.9675
          }
        }
      },
      "metricset": {
        "module": "system",
        "name": "cpu",
        "rtt": 201
      },
      "beat": {
        "name": "balahost2.com",
        "hostname": "balahost2.com",
        "version": "5.2.2"
      },
      "@version": "1",
      "host": "balahost2.com",
      "tags": [
        "beats_input_raw_event"
      ]
    },
    "hostname": "balahost2.com",
    "service": "index-bala"
  }

我在不修改映射的情况下找到的最终答案如下所示。

GET index-bala/_search
{
    "min_score": 1.0,
   "query": {

      "bool": {
         "must": [
            {
               "term": {
                  "hostname": "balahost1.com"
               }

            },
            {
               "exists": {
                  "field": "content.system.cpu"
               }
            }
         ]
      }
   }
}

1 个答案:

答案 0 :(得分:1)

这应该对你有用

<html>

<head>
  <script type='text/javascript'>
    var w = [];
    var p = [];
    var C = 0;
    var D = 0;

    function addFields() {
      // Number of inputs to create
      var number = document.getElementById("category_weight").value;
      // Container <div> where dynamic content will be placed
      var container = document.getElementById("container");
      // Clear previous contents of the container
      while (container.hasChildNodes()) {
        container.removeChild(container.lastChild);
      }
      for (i = 0; i < number; i++) {
        // create a row element to contain each pair
        var row = document.createElement("div");
        row.id = 'row' + i

        row.appendChild(document.createTextNode("Category " + (i + 1) + " weight: "));
        var weight_input = document.createElement("input");
        weight_input.type = "number";
        weight_input.name = "weight";
        row.appendChild(weight_input);

        row.appendChild(document.createTextNode("Category " + (i + 1) + " percentage: "));
        var percentage_input = document.createElement("input");
        percentage_input.type = "number";
        percentage_input.name = "percentage";
        row.appendChild(percentage_input);

        // append inputs to row instead of container, then append each row to container
        container.appendChild(row);
      }
    }

    function weighted() {

      var container = document.getElementById("container");
      var rows = container.children;
      for (var i = 0; i < rows.length; i++) {
        var row = rows[i];
        w[i] = row.children[0].value; // or row.querySelectorAll('[name=weight]').value;
        p[i] = row.children[1].value;

      }

      for (var i = 0; i < rows.length; i++) {
        // You can do as much calculation here with w[i] & p[i]
        C += w[i] * p[i];
        D += w[i];

      }
      console.log(C);
      console.log(D);

      var x = "";
      var A = parseFloat(document.getElementById("goal_grade").value);
      var B = parseFloat(document.getElementById("exam_weight").value);


      x = (A * (D + B) - C) / B;

      if (x <= 0) {
        x = 0;
      }

      document.getElementById("result").innerHTML = x;

    }
  </script>
</head>

<body>
  <span>What final percentage in the class are you trying to reach or stay         above?</span>
  <input type="number" id="goal_grade" name="goal_grade" />

  <br>
  <br>

  <span>What percent is the final exam weighted?</span>
  <input type="number" id="exam_weight" name="exam_weight" />

  <br>
  <br>

  <span>How many extra weighted categories are there?</span>
  <input type="number" id="category_weight" name="category_weight" value=""> <br />
  <button type="button" onclick="addFields()">Submit </button>
  <div id="container"></div>

  <br>
  <br>

  <input type="button" value="Calculate" onclick="weighted()" />

  <br>
  <br>

  <span>You will need to get <p id="result" name="r1"> </p> points out of the ... <p id="totpoints" name="tot_points"> </p> points possible on the final"
</span>

</body>

</html>

修改 { "query" : { "bool": { "must" : [ { "term" : { "name" : "Bala" } }, { "exists": { "field": "car" } } ] } } } 字段的映射为hostname,这意味着该字段已经过分析,如果您要搜索{"type": "string"},结果还会包含这些文档使用字段名称{match: {"hostname":"xxxxhostname.com"}}(有关详细信息,请查看elasticsearch analyzers)。原因是elasticsearch的分析仪。此外,您无法在分析字段上使用术语查询进行搜索。

您需要存储"anyhost.com"字段的未分析值才能对其执行hostname查询。据我了解,您使用的是弹性搜索的2.x版本,因此documentation link也是如此。对于term字段映射

,您需要这样的内容
hostname

您需要查询"hostname": { "type": "string", "fields": { "raw": { "type": "string", "index": "not_analyzed" } } } ,而不是查询hostname hostname.raw查询。

或者,如果您没有term进行分析,则可以不对其进行分析并对其进行查询

hostname