Question

我正在使用弹性很长一段时间，但我从未编写过获取某些数据的代码。现在我遇到了麻烦。

我有一个索引，我想要检索一些字段上投射的一些文档。我可以在SQL

中逐字编写它

SELECT myDocumentField
FROM myIndex

但由于某种原因，我得到的是空值而不是值。

我的索引中有6个文档。所以我写下面的查询：

var elasticServiceNumbers = await _elasticClient.SearchAsync<ElasticRequest>(
                                s => s.Query(Selector));

它按预期工作并返回这6个值，除了它们的所有字段都为空

好的，我也在尝试添加字段：

var elasticServiceNumbers = await _elasticClient.SearchAsync<ElasticRequest>(
                                s => s.StoredFields(sf => sf.Fields(f => f.ServiceNumber))
                                      .Query(Selector));
var elasticServiceNumbers2 = await _elasticClient.SearchAsync<ElasticRequest>(
                                s => s.Source(sf => sf.Includes(fds => fds.Field(f => f.ServiceNumber)))
                                      .Query(Selector));

但仍然运气不好，而且字段保持空值。

Kibana显示索引上存在此字段：

这里可能有什么问题？

Kibana查询

{
  "version": true,
  "size": 500,
  "sort": [
    {
      "_score": {
        "order": "desc"
      }
    }
  ],
  "_source": {
    "excludes": []
  },
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "3h",
        "time_zone": "Asia/Baghdad",
        "min_doc_count": 1
      }
    }
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    "@timestamp",
    "fields.Date",
    "fields.DeserializedMessage.Message.Date",
    "fields.DeserializedMessage.Message.Periods.Begin",
    "fields.DeserializedMessage.Message.Periods.End",
    "fields.DeserializedMessage.Message.ResponseDate",
    "fields.Periods.Begin",
    "fields.Periods.End",
    "fields.ResponseDate"
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match_all": {}
        },
        {
          "range": {
            "@timestamp": {
              "gte": 1527973200000,
              "lte": 1528577999999,
              "format": "epoch_millis"
            }
          }
        }
      ],
      "filter": [],
      "should": [],
      "must_not": []
    }
  },
  "highlight": {
    "pre_tags": [
      "@kibana-highlighted-field@"
    ],
    "post_tags": [
      "@/kibana-highlighted-field@"
    ],
    "fields": {
      "*": {}
    },
    "fragment_size": 2147483647
  }
}

Answer 1

看起来有问题的字段是doc value fields ，因为它们是可搜索和可聚合的，但不是存储，即发送到Elasticsearch的原始_source文档未存储

使用NEST获取doc值字段

var searchResponse = client.Search<ElasticRequest>(s => s
    .DocValueFields(f => f
        .Field(ff => ff.ServiceNumber.Suffix("keyword"))
    )
);

这是使用keyword的{{1}}映射，它看起来像是一个doc值字段。

Answer 2

Are the fields marked as STORED? I see they are INDEXED (searchable).

What about trying without any query?

var r = await _elasticClient.SearchAsync<ElasticRequest>(s=>s.From(0).Size(10));

NEST返回null而不是字段

2 个答案: