使用应该的弹性搜索查询不起作用

Question

我想过滤包含“未找到类别的数据库记录：”或“数据库中并非所有代码都匹配类别：”的消息。但是查询 returns 所有不匹配的消息包含上述短语。

{
  "query": {
    "bool": {
      "filter": {"range": {"timestamp": {"gte": "now-1h/h"}}},
      "should": [
        {"match_phrase": { "message": "No DB record found for Category:"}},
        {"match_phrase": { "message": "Not all codes match in DB for Category:" }}
      ]
    }
  }
}

Answer 1

很好的开始，您只是缺少 minimum_should_match（当查询包含 must 或 filter，则 minimum_should_match 为 0，因此您需要指定它):

{
  "query": {
    "bool": {
      "filter": {"range": {"timestamp": {"gte": "now-1h/h"}}},
      "minimum_should_match": 1,                                  <---- ADD THIS
      "should": [
        {"match_phrase": { "message": "No DB record found for Category:"}},
        {"match_phrase": { "message": "Not all codes match in DB for Category:" }}
      ]
    }
  }
}

使用应该的弹性搜索查询不起作用

Elastic Search Query using should is not working

elasticsearch

elasticsearch-5