按字段过滤（如果存在），弹性搜索

Question

我的文档中有一个日期字段，我只想返回日期少于现在的文档-5m，但是并不是我的所有文档都已归档，它们只在第一次被单独查询时才会收到。 / p>

 documents = es.search(index='index_name', size=10000, body={
          "query": {
    "bool": {
      "must": [
                {
              "range": {
                  "time_lockout": {
                      "lt": "now-5m"
                  }
              }
          }
      ],
      "filter": [

      ],
      "should": [

      ],

      "must_not": [
      ]
    }
  }})

所以我的伪代码应该是

if `time_lockout` exists
    give documents that are now-5 including all documents thats dont have `time_lockout` 

Exclude documents that dat range falls withon that 5 minute window

Answer 1

将查询更新到以下位置：

{
  "query": {
    "bool": {
      "should": [
        {
          "range": {
            "time_lockout": {
              "lt": "now-5m"
            }
          }
        },
        {
          "bool": {
            "must_not": [
              {
                "exists": {
                  "field": "time_lockout"
                }
              }
            ]
          }
        }
      ]
    }
  }
}