源过滤Elasticsearch中嵌套的JSON格式文档中的所选多个字段

时间:2018-10-06 14:56:43

标签: elasticsearch kibana

在我的Elasticsearch索引test_index中,我有许多具有以下结构的JSON格式的文档。

{
        "_index": "test_index",
        "_type": "_doc",
        "_id": "index10",
        "_score": 1,
        "_source": {
          "id_name": "index10",
          "further_details": {
            "nest1": {
              "section1": {
                "sectionnest1": {
                  "fielding11": "value11",
                  "fielding12": "value12",
                  "fielding13": "value13",
                  "fielding14": {
                    "subfielding141": "subvalue141",
                    "subfielding142": "subvalue142",
                    "subfielding143": "subvalue143"
                  },
                  "fielding15": "value15",
                  "fielding16": "value16",
                  "fielding17": "value16",
                  "fielding18": {
                    "subfielding181": "subvalue181",
                    "subfielding182": "20-DEC-2013 07:09:43",
                    "subfielding183": "0",
                    "subfielding184": "subvalue184",
                    "subfielding185": "subvalue185",
                    "subfielding186": "subvalue186",
                    "subfielding187": "subvalue187"
                  },
                  "fielding19": "value19",
                }
              },
              "sectionnest2": {
                "fielding21": [
                  "arrayvalue21"
                ]
              },
              "sectionnest3": {
                "fielding31": "value31",
                "fielding32": "value32",
                "fielding33": "value33",
                "fielding34": "value34",
                "fielding35": "value35",
                "fielding36": {
                  "subfielding361": "subvalue361"
                }
              }
            },
            "section2": {
                "sectionnest1": {
                  "fielding11": "value21",
                  "fielding12": "value22",
                  "fielding13": "value23",
                  "fielding14": {
                    "subfielding141": "subvalue241",
                    "subfielding142": "subvalue242",
                    "subfielding143": "subvalue243"
                  },
                  "fielding15": "value25",
                  "fielding16": "value26",
                  "fielding17": "value26",
                  "fielding18": {
                    "subfielding181": "subvalue281",
                    "subfielding182": "20-DEC-2014 08:09:43",
                    "subfielding183": "0",
                    "subfielding184": "subvalue284",
                    "subfielding185": "subvalue285",
                    "subfielding186": "subvalue286",
                    "subfielding187": "subvalue287"
                  },
                  "fielding19": "value29",
                }
              },
              "sectionnest2": {
                "fielding21": [
                  "arrayvalue21"
                ]
              },
              "sectionnest3": {
                "fielding31": "value231",
                "fielding32": "value232",
                "fielding33": "value233",
                "fielding34": "value234",
                "fielding35": "value235",
                "fielding36": {
                  "subfielding361": "subvalue2361"
                }
              }
            },
            "section3": {
                "sectionnest1": {
                  "fielding11": "value31",
                  "fielding12": "value32",
                  "fielding13": "value33",
                  "fielding14": {
                    "subfielding141": "subvalue341",
                    "subfielding142": "subvalue342",
                    "subfielding143": "subvalue343"
                  },
                  "fielding15": "value35",
                  "fielding16": "value36",
                  "fielding17": "value36",
                  "fielding18": {
                    "subfielding181": "subvalue381",
                    "subfielding182": "20-DEC-2017 08:10:43",
                    "subfielding183": "0",
                    "subfielding184": "subvalue384",
                    "subfielding185": "subvalue385",
                    "subfielding186": "subvalue386",
                    "subfielding187": "subvalue387"
                  },
                  "fielding19": "value39",
                }
              },
              "sectionnest2": {
                "fielding21": [
                  "arrayvalue31"
                ]
              },
              "sectionnest3": {
                "fielding31": "value4331",
                "fielding32": "value4332",
                "fielding33": "value4333",
                "fielding34": "value4334",
                "fielding35": "value4335",
                "fielding36": {
                  "subfielding361": "subvalue43361"
                }
              }
            }
          }
        }
      }

在上面的示例文档中,我可以使用查询

来获取数据section1, section2, section3(我想要的)
POST test_index/_search
{
  "size": 10,
  "_source": {
    "includes": [ "further_details.*.nest1.*" ],
    "excludes": [ "further_details.*.nest1.*.*" ]
  }
}

但是,如果我想获取数据section1, section2, section3subfielding141的值,以下尝试的查询将无法正常工作。

POST test_index/_search
{
  "size": 10,
  "_source": {
    "includes": [ "further_details.*.nest1.*", "further_details.*subfielding141" ],
    "excludes": [ "further_details.*.nest1.*.*" ]
  }
}

因此担心它与Elasticsearch的预期行为还是我做错了。我试图检查文档,但这些文档对我没有帮助。

0 个答案:

没有答案