需要帮助在 elasticsearch 中结合通配符搜索和范围查询吗？

Question

我正在尝试在弹性搜索查询中结合通配符和日期范围，但没有根据通配符搜索给出响应。它返回包含日期范围不正确的项目的响应。

{
  "from": 0,
  "size": 10,
  "query": {
    "bool": {
      "must": [
        {
          "bool": {
            "should": [
              {
                "wildcard": {
                  "hostName": "*abc*"
                }
              },
              {
                "range": {
                  "requestDate": {
                    "gte": "2019-10-01T08:00:00.000Z"
                  }
                }
              }
            ]
          }
        }
      ]
    }
  }
}

索引映射如下所示：

{
  "index_history": {
    "mappings": {
      "applications_datalake": {
        "properties": {
          "query": {
            "properties": {
              "term": {
                "properties": {
                  "server": {
                    "type": "text",
                    "fields": {
                      "keyword": {
                        "type": "keyword",
                        "ignore_above": 256
                      }
                    }
                  }
                }
              }
            }
          }
        }
      },
      "index-data-type": {
        "properties": {
          "attributes": {
            "properties": {
              "wwnListForServer": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword",
                    "ignore_above": 256
                  }
                }
              }
            }
          },
          "hostName": {
            "type": "keyword"
          },
          "requestDate": {
            "type": "date"
          },
          "requestedBy": {
            "properties": {
              "id": {
                "type": "keyword"
              },
              "name": {
                "type": "keyword"
              }
            }
          }
        }
      }
    }
  }
}

Answer 1

您错过了 minimum_should_match 参数， 看一下这个 ： https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-query.html.
我认为您的查询应如下所示：

{
  "from": 0,
  "size": 10,
  "query": {
    "bool": {
      "must": [
        {
          "bool": {
            "should": [
              {
                "wildcard": {
                  "hostName": "*abc*"
                }
              },
              {
                "range": {
                  "requestDate": {
                    "gte": "2019-10-01T08:00:00.000Z"
                  }
                }
              }
            ],
            "minimum_should_match" : 2
          }
        }
      ]
    }
  }
}

来自文档：

You can use the minimum_should_match parameter to specify the number or percentage of should clauses returned documents must match.

If the bool query includes at least one should clause and no must or filter clauses, the default value is 1. Otherwise, the default value is 0.

Answer 2

根据您的映射，您必须为 hostName 和 requestDate 字段调出完全限定的 属性。示例：

"wildcard": {    
  "index-data-type.hostName": {
    "value": "..."
  }
}

此外，还可以考虑将复合查询减少为主要 bool 查询，使用 must 子句并应用过滤器。示例：

{
  "from": 0, 
  "size": 20, 
  "query": {
    "bool": {
      "must": [
        {
          "wildcard": {
            "index-data-type.hostName": {
              "value": "*abc*"
            }
          }
        }
      ],
      "filter": {
        "range": {
          "index-data-type.requestDate": {
            "gte": "2019-10-01T08:00:00.000Z"
          }
        }
      }
    }
  }
}

过滤器上下文对 _score 没有贡献，但它减少了 hits.

的数量

Warnining: Using the leading asterisk (*) on a wildcard query can have severe performance impacts to your queries.