Elasticsearch:通过嵌套对象查询查找内部命中

时间:2019-11-27 10:59:43

标签: elasticsearch nested time-series

我有一个伪文件,像这样:

{
    "snapshots": [
        {
            "code":"[id]",
            "dateFrom": "[Date]",
            "dateTo": "[Date]",
            "attribute1": "[Some value]",
            "attribute2": "[Some value]"
        }, {
            "code":"[id]",
            "dateFrom": "[Date]",
            "dateTo": "[Date]",
            "attribute2": "[Some value]"
        }
    ],
    "attributeXYZ":[
        {
            "dateFrom": "[Date]",
            "dateTo": "[Date]",
            "attributeXYZ": "[Some value]"
        },
        {
            "dateFrom": "[Date]",
            "dateTo": "[Date]",
            "attributeXYZ": "[Some value]"
        }
    ],
    "attributeZYX":[
        {
            "dateFrom": "[Date]",
            "dateTo": "[Date]",
            "attributeZYX": "[Some value]"
        },
        {
            "dateFrom": "[Date]",
            "dateTo": "[Date]",
            "attributeZYX": "[Some value]"
        }
    ]
}

字段“快照”,“ attributeXYZ”,“ attributeZYX”是嵌套对象。是否可以从条件为例如snapshots.attribute1="Some value" AND attributeXYZ.attributeXYZ="Some value" AND snapshots.dateFrom<attributeXYZ.dateTo AND snapshots.dateTo>attributeXYZ.dateFrom的快照(字段snapshots.dateFrom,snapshots.dateTo,snapshots.code)中选择内部命中对象?因此,我想跨嵌套对象进行查询,并且日期时间上下文必须重叠。我正在使用嵌套聚合,但是还没有成功。

谢谢。

1 个答案:

答案 0 :(得分:0)

要查询嵌套字段,您需要构造嵌套查询-假设在您的示例中过滤器是snapshots.attribute1 =“ Some value” AND attributeXYZ.attributeXYZ =“ Some value” AND snapshots.dateFromattributeXYZ.dateFrom? 因此,您需要将这三个条件放在一个布尔中-必须查询:

DEBUG=* webpack [-c webpack.something.js]

如果相反,您需要OR条件,则可以将所有Or-ed候选对象放在“ should”子句中,并将Should子句的minimum_should_match属性设置为“ 1”。

来到聚合部分,您可以看一下这个问题-How to get nested aggregations buckets using java high level REST client Elasticsearch