使用OR和通配符查询Elasticsearch

Question

我试图对我的elasticsearch _type做一个简单的查询，并用通配符匹配多个字段，我的第一次尝试是这样的：

POST my_index/my_type/_search
{
  "sort" : { "date_field" : {"order" : "desc"}},
  "query" : {
    "filtered" : {
      "filter" : {
        "or" : [
          {
              "term" : { "field1" : "4848" }
          },
          {
              "term" : { "field2" : "6867" }
          }
        ]
      }
    }
  }
}

当field1或field2分别分别等于4848和6867时，此示例将成功匹配每个记录。

我想做的是在field1上匹配任何包含4848的文本和field6包含6867的文本，但是我不确定如何执行此操作。

我感谢我能得到的任何帮助:)

Answer 1

听起来您的问题主要与分析有关 。 适当的解决方案取决于您的数据结构和要匹配的内容。 我将提供一些示例。

首先，假设您的数据足以使我们仅使用标准分析仪就可以得到想要的数据。 该分析器将标记空白，标点和符号上的文本字段。 因此，文本"1234-5678-90"将分为术语"1234" ， "5678"和"90" ，因此针对任何这些术语的"term"查询或过滤器都将与该文档匹配。 更具体地说：

DELETE /test_index

PUT /test_index
{
   "settings": {
      "number_of_shards": 1
   },
   "mappings": {
       "doc": {
           "properties": {
               "field1":{
                   "type": "string",
                   "analyzer": "standard"
               },
               "field2":{
                   "type": "string",
                   "analyzer": "standard"
               }
           }
       }
   }
}

POST /test_index/_bulk
{"index":{"_index":"test_index","_type":"doc","_id":1}}
{"field1": "1212-2323-4848","field2": "1234-5678-90"}
{"index":{"_index":"test_index","_type":"doc","_id":2}}
{"field1": "0000-0000-0000","field2": "0987-6543-21"}
{"index":{"_index":"test_index","_type":"doc","_id":3}}
{"field1": "1111-2222-3333","field2": "6867-4545-90"}

POST test_index/_search
{
   "query": {
      "filtered": {
         "filter": {
            "or": [
               {
                  "term": { "field1": "4848" }
               },
               {
                  "term": { "field2": "6867" }
               }
            ]
         }
      }
   }
}
...
{
   "took": 3,
   "timed_out": false,
   "_shards": {
      "total": 1,
      "successful": 1,
      "failed": 0
   },
   "hits": {
      "total": 2,
      "max_score": 1,
      "hits": [
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "1",
            "_score": 1,
            "_source": {
               "field1": "1212-2323-4848",
               "field2": "1234-5678-90"
            }
         },
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "3",
            "_score": 1,
            "_source": {
               "field1": "1111-2222-3333",
               "field2": "6867-4545-90"
            }
         }
      ]
   }
}

（明确地写"analyzer": "standard"是多余的，因为如果您不指定它，则它是默认的分析器；我只是想让它变得显而易见。）

另一方面，如果以某种方式嵌入文本，以至于标准分析无法提供您想要的内容，请说"121223234848"而您想匹配"4848" ，则您将不得不做更多的事情复杂，使用ngrams 。 这是一个示例（请注意数据中的差异）：

DELETE /test_index

PUT /test_index
{
   "settings": {
      "analysis": {
         "filter": {
            "nGram_filter": {
               "type": "nGram",
               "min_gram": 2,
               "max_gram": 20,
               "token_chars": [
                  "letter",
                  "digit",
                  "punctuation",
                  "symbol"
               ]
            }
         },
         "analyzer": {
            "nGram_analyzer": {
               "type": "custom",
               "tokenizer": "whitespace",
               "filter": [
                  "lowercase",
                  "asciifolding",
                  "nGram_filter"
               ]
            },
            "whitespace_analyzer": {
               "type": "custom",
               "tokenizer": "whitespace",
               "filter": [
                  "lowercase",
                  "asciifolding"
               ]
            }
         }
      }
   },
   "mappings": {
      "doc": {
          "properties": {
               "field1":{
                   "type": "string",
                   "index_analyzer": "nGram_analyzer", 
                   "search_analyzer": "whitespace_analyzer"
               },
               "field2":{
                   "type": "string",
                   "index_analyzer": "nGram_analyzer", 
                   "search_analyzer": "whitespace_analyzer"
               }
           }
      }
   }
}

POST /test_index/_bulk
{"index":{"_index":"test_index","_type":"doc","_id":1}}
{"field1": "121223234848","field2": "1234567890"}
{"index":{"_index":"test_index","_type":"doc","_id":2}}
{"field1": "000000000000","field2": "0987654321"}
{"index":{"_index":"test_index","_type":"doc","_id":3}}
{"field1": "111122223333","field2": "6867454590"}


POST test_index/_search
{
   "query": {
      "filtered": {
         "filter": {
            "or": [
               {
                  "term": { "field1": "4848" }
               },
               {
                  "term": { "field2": "6867" }
               }
            ]
         }
      }
   }
}
...
{
   "took": 8,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 2,
      "max_score": 1,
      "hits": [
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "1",
            "_score": 1,
            "_source": {
               "field1": "121223234848",
               "field2": "1234567890"
            }
         },
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "3",
            "_score": 1,
            "_source": {
               "field1": "111122223333",
               "field2": "6867454590"
            }
         }
      ]
   }
}

这里发生了很多事情，所以我不会尝试在这篇文章中解释它。 如果您需要更多说明，建议您阅读此博客文章： http : //blog.qbox.io/multi-field-partial-word-autocomplete-in-elasticsearch-using-ngrams 。 希望您能原谅无耻的外表。 ;）

希望能有所帮助。