如何在Elasticsearch中使用query_string语法搜索这组字段

Question

It could be that I've created my index wrong, but I have a lead index with variable field names that I need to search through. I created a sub object called fields that contains name and value. Sample:

[
  {
    "name": "first_name",
    "value": "XXX"
  },
  {
    "name": "last_name",
    "value": "XXX"
  },
  {
    "name": "email",
    "value": "X0@yahoo.com"
  },
  {
    "name": "address",
    "value": "X Thomas RD Apt 1023"
  },
  {
    "name": "city",
    "value": "phoenix"
  },
  {
    "name": "state",
    "value": "AZ"
  },
  {
    "name": "zip",
    "value": "12345"
  },
  {
    "name": "phone",
    "value": "5554448888"
  },
  {
    "name": "message",
    "value": "recently had XXXX"
  }
]

name field is not_analyzed , and value field is analyzed and not, as .exact and .search

I thought I could get the results I want from a query string query doing something like

+fields.name: first_name +fields.value.exact: XXX

But it doesn't quite work the way I thought. I figure its because I'm trying to use this as mysql instead of as nosql, and there is a fundamental brain shift I must have.

Answer 1

While the approach you are taking probably should work with enough effort, you are much better off having explicit field names for everything, eg: { "name.first_name" : "XXX", "name.last_name" : "XXX", etc... }

Then your query_string looks like this: name.first_name:XXX

If you are a new to elasticsearch, play around with things before you add your mappings. The dynamic defaults should kick in and things will work. You then add mappings to get fine grained control over the field behavior.