我的查询有什么问题吗.Nest elastic C#

Question

我的 .Nest 库查询有问题吗？我的查询将获取所有数据，我需要按多个术语获取。我想要的查询字符串弹性结果：

{
   "took": 2,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 1000,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "log_query": {
         "doc_count": 2,
         "histogram_Log": {
            "buckets": [
               {
                  "key_as_string": "06/02/2015 12:00:00",
                  "key": 1423180800000,
                  "doc_count": 1
               },
               {
                  "key_as_string": "21/02/2015 12:00:00",
                  "key": 1424476800000,
                  "doc_count": 1
               }
            ]
         }
      }
   }
}

我的查询字符串弹性：

{
  "size": 0,
  "aggs": {
    "log_query": {
      "filter": {
        "bool": {
          "must": [
            {
              "term": {
                "cluster": "giauht1"
              }
            },
            {
              "term": {
                "server": "hadoop0"
              }
            },
            {
              "term": {
                "type": "Warn"
              }
            },
            {
              "range": {
                "actionTime": {
                  "gte": "2015-02-01",
                  "lte": "2015-02-24"
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "histogram_Log": {
          "date_histogram": {
            "field": "actionTime",
            "interval": "1d",
            "format": "dd/MM/YYYY hh:mm:ss"
          }
        }
      }
    }
  }
}

我的 .nest 库查询：

 Func<SearchDescriptor<LogInfoIndexView>, SearchDescriptor<LogInfoIndexView>> query =
                que => que.Aggregations(aggs => aggs.Filter("log_query", fil =>
                {
                    fil.Filter(fb => fb.Bool(fm => fm.Must(
                        ftm =>
                        {
                            ftm.Term(t => t.Cluster, cluster);
                            ftm.Term(t => t.Server, server);
                            ftm.Term(t => t.Type, logLevel);
                            ftm.Range(r => r.OnField("actionTime").GreaterOrEquals(from.Value).LowerOrEquals(to.Value));
                            return ftm;
                        }))).Aggregations(faggs => faggs.DateHistogram("histogram_Log", dr =>
                    {
                        dr.Field("actionTime");
                        dr.Interval("1d");
                        dr.Format("dd/MM/YYYY hh:mm:ss");
                        return dr;
                    }));
                    return fil;
                })).Size(0).Type(new LogInfoIndexView().TypeName);
            var result = client.Search(query);

我的.nest 结果：

我的模型映射：

{
   "onef-sora": {
      "mappings": {
         "FPT.OneF.Api.Log": {
            "properties": {
               "actionTime": {
                  "type": "date",
                  "format": "dateOptionalTime"
               },
               "application": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "cluster": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "detail": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "iD": {
                  "type": "string"
               },
               "message": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "server": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "source": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "tags": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "type": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "typeLog": {
                  "type": "string"
               },
               "typeName": {
                  "type": "string"
               },
               "url": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "user": {
                  "type": "string",
                  "index": "not_analyzed"
               }
            }
         }
      }
   }
}

Answer 1

传递给 Bool() 过滤器的 Must() 条件采用 params Func<FilterDescriptor<T>, FilterContainer>[]，但在您的过滤器中，Term() 和 Range() 过滤器链接到相同的过滤器实例；不幸的是，这并不像您可能期望的那样工作，最终结果实际上是一个空的 json 对象传递给查询 DSL 中的 must 子句过滤，即你最终得到

{
  "size": 0,
  "aggs": {
    "log_query": {
      "filter": {
        "bool": {
          "must": [
            {} /* where are the filters?! */
          ]
        }
      },
      "aggs": {
        "histogram_Log": {
          "date_histogram": {
            "field": "actionTime",
            "interval": "1d",
            "format": "dd/MM/YYYY hh:mm:ss"
          }
        }
      }
    }
  }
}

解决方法是传递一个Func<FilterDescriptor<T>, FilterContainer>的数组；以下符合您的查询 DSL

void Main()
{
    var settings = new ConnectionSettings(new Uri("http://localhost:9200"));
    var connection = new InMemoryConnection(settings);
    var client = new ElasticClient(connection: connection);

    DateTime? from = new DateTime(2015, 2,1);
    DateTime? to = new DateTime(2015, 2, 24);

    var docs = client.Search<LogInfoIndexView>(s => s
        .Size(0)
        .Type("type")
        .Aggregations(a => a
            .Filter("log_query", f => f
                .Filter(ff => ff
                    .Bool(b => b
                        .Must(m => m
                            .Term(t => t.Cluster, "giauht1"),
                              m => m
                            .Term(t => t.Server, "hadoop0"),
                              m => m
                            .Term(t => t.Type, "Warn"),
                              m => m
                            .Range(r => r.OnField("actionTime").GreaterOrEquals(from.Value).LowerOrEquals(to.Value))
                        )
                    )
                )
                .Aggregations(aa => aa
                    .DateHistogram("histogram_Log", da => da
                        .Field("actionTime")
                        .Interval("1d")
                        .Format("dd/MM/YYYY hh:mm:ss")
                    )
                )
            )
        )
    );

    Console.WriteLine(Encoding.UTF8.GetString(docs.RequestInformation.Request));
}

public class LogInfoIndexView
{
    public string Cluster { get; set; }
    public string Server { get; set; }
    public string Type { get; set; }
    public DateTime ActionTime { get; set; }    
}

返回

{
  "size": 0,
  "aggs": {
    "log_query": {
      "filter": {
        "bool": {
          "must": [
            {
              "term": {
                "cluster": "giauht1"
              }
            },
            {
              "term": {
                "server": "hadoop0"
              }
            },
            {
              "term": {
                "type": "Warn"
              }
            },
            {
              "range": {
                "actionTime": {
                  "lte": "2015-02-24T00:00:00.000",
                  "gte": "2015-02-01T00:00:00.000"
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "histogram_Log": {
          "date_histogram": {
            "field": "actionTime",
            "interval": "1d",
            "format": "dd/MM/YYYY hh:mm:ss"
          }
        }
      }
    }
  }
}

编辑：

在回答您的评论时，filtered query filter and a filter aggregation 之间的区别在于前者在查询阶段开始时将过滤应用于所有文档，并且过滤器通常被缓存，从而提高后续查询的性能过滤器，而后者适用于聚合范围，将当前上下文中的文档过滤到单个桶中。如果您的查询只是为了执行聚合并且您可能运行使用相同的过滤器进行聚合，我认为 filtered query filter 应该提供更好的性能。

我的查询有什么问题吗.Nest elastic C#

Is Anything wrong in my query .Nest elastic C#

c#

elasticsearch

nest