使用Elasticsearch对子字段数组进行范围查询

Question

I'm trying to get all the services with a code different than 0, I don't find any way to do it without doing multiple queries. Here's the data i'm trying to query, thanks in advance for the help

      "hits": [
     {
        "_index": "database_index",
        "_type": "system",
        "_id": "AV03gG7B3dd3_xKqi09H",
        "_score": 1,
        "_source": {
           "name_id": "BOX",
           "room_id": "63190",
           "event": "SysMonitor",
           "data": {
              "ip": "192.168.60.25 \n",
              "ns": "192.168.0.1\n",
              "uptime": "3:12"
           },
           "services": {
              "apache2": 1,
              "gw-flash": 0,
              "appmgr": 0,
              "watchdog": 2,
              "gui": 0,
              "usb": 0,
              "internet": 0
           },

Answer 1

This is a classic fulltext search example, where one could write a very complicated query to cover this or you could optimize this on index time and thus have very cheap queries. If you change your data model to have a field that contains all the services that have a value of 0 or 1 , you could easily search for that, ie

services_zero: [gwflash, appmgr]
services_one: [ apache2 ]

Suddenly your query can easily search or aggregate against those fields.

Not saying that this will perfectly fit your use-case, but I think it is worth to rethink the data modelling strategy here.