[英]How do I create an ElasticSearch query without knowing what the field is?
I have someone putting JSON objects into Elasticsearch for which I do not know any fields. 我有人将JSON对象放入Elasticsearch,但我不知道任何字段。 I would like to search all the fields for a given value using a matchQuery. 我想使用matchQuery在所有字段中搜索给定值。
I understand that the _all is deprecated, and the copy_to doesn't work because I don't know what fields are available beforehand. 我知道_all已弃用,并且copy_to不起作用,因为我不知道事先有哪些字段可用。 Is there a way to accomplish this without knowing what fields to search for beforehand? 有没有一种方法可以完成此操作而无需事先知道要搜索哪些字段?
Yes, you can achieve this using a custom _all
field (which I called my_all
) and a dynamic template for your index. 是的,您可以使用自定义_all
字段(我称为my_all
)和动态索引模板来实现此_all
。 Basically, this idea is to have a generic mapping for all fields with a copy_to
setting to the my_all
field. 基本上,此想法是对所有字段进行通用映射, copy_to
设置设置为my_all
字段。 I've also added store: true
for the my_all
field but only for the purpose of showing you that it works, in practice you won't need it. 我还为my_all
字段添加了store: true
,但仅是为了向您展示它的工作原理,实际上,您将不需要它。
So let's go and create the index: 现在开始创建索引:
PUT my_index
{
"mappings": {
"_doc": {
"dynamic_templates": [
{
"all_fields": {
"match": "*",
"mapping": {
"copy_to": "my_all"
}
}
}
],
"properties": {
"my_all": {
"type": "text",
"store": true
}
}
}
}
}
Then index a document: 然后索引一个文档:
PUT my_index/_doc/1
{
"test": "the cat drinks milk",
"age": 10,
"alive": true,
"date": "2018-03-21T10:00:00.123Z",
"val": ["data", "data2", "data3"]
}
Finally, we can search using the my_all
field and also show its content (because we store its content) in addition to the _source
of the document: 最后,除了文档的_source
之外,我们还可以使用my_all
字段进行搜索并显示其内容(因为我们存储了其内容):
GET my_index/_search?q=my_all:cat&_source=true&stored_fields=my_all
And the result is shown below: 结果如下所示:
{
"_index": "my_index",
"_type": "_doc",
"_id": "1",
"_score": 0.2876821,
"_source": {
"test": "the cat drinks milk",
"age": 10,
"alive": true,
"date": "2018-03-21T10:00:00.123Z",
"val": [
"data",
"data2",
"data3"
]
},
"fields": {
"my_all": [
"the cat drinks milk",
"10",
"true",
"2018-03-21T10:00:00.123Z",
"data",
"data2",
"data3"
]
}
}
So given you can create the index and mapping of your index, you'll be able to search whatever people are sending to it. 因此,只要您可以创建索引和索引映射,就可以搜索人们发送给它的任何内容。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.