为什么我的 ElasticSearch 查询没有获取任何记录？

Question

我运行以下查询：

{
    "size": 50,
    "_source" : ["servername", "silo", "packages.displayname", "packages.displayversion","environment"],

  "query": {
    "bool": {
      "must": {
        "match": {
          "packages.displayname": "Google Chrome"
        }
      }
      ,
       "must": {
        "type": {
          "value": "server"
        }
      }
    }
  }
}

但是它没有获取任何记录

{
    "took": 1,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 0,
        "max_score": null,
        "hits": []
    }
}

然而，有关 index\type 有一些记录 "packages.displayname" = "Google Chrome"，下面是 index\type

的示例

{
    "took": 78,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 994,
        "max_score": 1,
        "hits": [
            {
                "_index": "package_conformity-13.02.2019",
                "_type": "server",
                "_id": "AWjklhaPsoJF1yu58sfg",
                "_score": 1,
                "_source": {
                    "environment": "PRD",
                    "servername": "Zephyr",
                    "packages": [
                        {
                            "displayname": "Google Chrome",
                            "displayversion": "71.0.3578.80"
                        },

这是索引映射：

{
    "package_conformity-13.02.2019": {
        "mappings": {
            "server": {
                "properties": {
                    "environment": {
                        "type": "keyword"
                    },
                    "farm": {
                        "type": "keyword"
                    },
                    "packages": {
                        "type": "nested",
                        "properties": {
                            "InstallDate": {
                                "type": "date",
                                "index": false
                            },
                            "InstallLocation": {
                                "type": "text",
                                "index": false
                            },
                            "comments": {
                                "type": "text",
                                "index": false
                            },
                            "displayname": {
                                "type": "keyword"
                            },
                            "displayversion": {
                                "type": "keyword",
                                "index": false
                            },
                            "publisher": {
                                "type": "text",
                                "index": false
                            },
                            "regkey": {
                                "type": "keyword",
                                "index": false
                            }
                        }
                    },
                    "servername": {
                        "type": "keyword"
                    },
                    "silo": {
                        "type": "keyword"
                    },
                    "timestamp": {
                        "type": "date",
                        "format": "yyyy-MM-dd HH:mm:ss"
                    }
                }
            }
        }
    }
}

是不是查询方式、索引结构或内容有问题？请帮助我指出正确的方法..

谢谢

Answer 1

如果你想在 must 子句中使用多个约束，你需要有一个数组（并且不要多次重复 must 关键字）。此外，应该使用 term 查询以不同方式对 _type 进行约束。试试这个查询：

{
  "size": 50,
  "_source": [
    "servername",
    "silo",
    "packages.displayname",
    "packages.displayversion",
    "environment"
  ],
  "query": {
    "bool": {
      "must": [
        {
          "nested": {
            "path": "packages",
            "query": {
              "match": {
                "packages.displayname": "Google Chrome"
              }
            }
          }
        },
        {
          "term": {
            "_type": "server"
          }
        }
      ]
    }
  }
}