在我的查询中有什么问题.Nest elastic C＃

Question

我的.Nest libs查询中有什么问题吗？ 我的查询将获得所有数据，我需要多学期获得。 查询字符串弹性结果我想：

{
   "took": 2,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 1000,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "log_query": {
         "doc_count": 2,
         "histogram_Log": {
            "buckets": [
               {
                  "key_as_string": "06/02/2015 12:00:00",
                  "key": 1423180800000,
                  "doc_count": 1
               },
               {
                  "key_as_string": "21/02/2015 12:00:00",
                  "key": 1424476800000,
                  "doc_count": 1
               }
            ]
         }
      }
   }
}

我的查询字符串弹性：

{
  "size": 0,
  "aggs": {
    "log_query": {
      "filter": {
        "bool": {
          "must": [
            {
              "term": {
                "cluster": "giauht1"
              }
            },
            {
              "term": {
                "server": "hadoop0"
              }
            },
            {
              "term": {
                "type": "Warn"
              }
            },
            {
              "range": {
                "actionTime": {
                  "gte": "2015-02-01",
                  "lte": "2015-02-24"
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "histogram_Log": {
          "date_histogram": {
            "field": "actionTime",
            "interval": "1d",
            "format": "dd/MM/YYYY hh:mm:ss"
          }
        }
      }
    }
  }
}

我的.nest库查询：

 Func<SearchDescriptor<LogInfoIndexView>, SearchDescriptor<LogInfoIndexView>> query =
                que => que.Aggregations(aggs => aggs.Filter("log_query", fil =>
                {
                    fil.Filter(fb => fb.Bool(fm => fm.Must(
                        ftm =>
                        {
                            ftm.Term(t => t.Cluster, cluster);
                            ftm.Term(t => t.Server, server);
                            ftm.Term(t => t.Type, logLevel);
                            ftm.Range(r => r.OnField("actionTime").GreaterOrEquals(from.Value).LowerOrEquals(to.Value));
                            return ftm;
                        }))).Aggregations(faggs => faggs.DateHistogram("histogram_Log", dr =>
                    {
                        dr.Field("actionTime");
                        dr.Interval("1d");
                        dr.Format("dd/MM/YYYY hh:mm:ss");
                        return dr;
                    }));
                    return fil;
                })).Size(0).Type(new LogInfoIndexView().TypeName);
            var result = client.Search(query);

我的最终结果：

我的模型映射：

{
   "onef-sora": {
      "mappings": {
         "FPT.OneF.Api.Log": {
            "properties": {
               "actionTime": {
                  "type": "date",
                  "format": "dateOptionalTime"
               },
               "application": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "cluster": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "detail": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "iD": {
                  "type": "string"
               },
               "message": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "server": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "source": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "tags": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "type": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "typeLog": {
                  "type": "string"
               },
               "typeName": {
                  "type": "string"
               },
               "url": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "user": {
                  "type": "string",
                  "index": "not_analyzed"
               }
            }
         }
      }
   }
}

Answer 1

传递给Bool()过滤器的Must()条件采用了params Func<FilterDescriptor<T>, FilterContainer>[]但是在过滤器中， Term()和Range()过滤器被链接到同一个过滤器实例上; 不幸的是，这也不行，你可能会想到最终的结果实际上是传递到一个空的JSON对象must子句中的查询DSL的过滤器，即你结束了

{
  "size": 0,
  "aggs": {
    "log_query": {
      "filter": {
        "bool": {
          "must": [
            {} /* where are the filters?! */
          ]
        }
      },
      "aggs": {
        "histogram_Log": {
          "date_histogram": {
            "field": "actionTime",
            "interval": "1d",
            "format": "dd/MM/YYYY hh:mm:ss"
          }
        }
      }
    }
  }
}

解决方案是传递一个Func<FilterDescriptor<T>, FilterContainer>的数组; 以下内容与您的查询DSL相匹配

void Main()
{
    var settings = new ConnectionSettings(new Uri("http://localhost:9200"));
    var connection = new InMemoryConnection(settings);
    var client = new ElasticClient(connection: connection);

    DateTime? from = new DateTime(2015, 2,1);
    DateTime? to = new DateTime(2015, 2, 24);

    var docs = client.Search<LogInfoIndexView>(s => s
        .Size(0)
        .Type("type")
        .Aggregations(a => a
            .Filter("log_query", f => f
                .Filter(ff => ff
                    .Bool(b => b
                        .Must(m => m
                            .Term(t => t.Cluster, "giauht1"),
                              m => m
                            .Term(t => t.Server, "hadoop0"),
                              m => m
                            .Term(t => t.Type, "Warn"),
                              m => m
                            .Range(r => r.OnField("actionTime").GreaterOrEquals(from.Value).LowerOrEquals(to.Value))
                        )
                    )
                )
                .Aggregations(aa => aa
                    .DateHistogram("histogram_Log", da => da
                        .Field("actionTime")
                        .Interval("1d")
                        .Format("dd/MM/YYYY hh:mm:ss")
                    )
                )
            )
        )
    );

    Console.WriteLine(Encoding.UTF8.GetString(docs.RequestInformation.Request));
}

public class LogInfoIndexView
{
    public string Cluster { get; set; }
    public string Server { get; set; }
    public string Type { get; set; }
    public DateTime ActionTime { get; set; }    
}

回国

{
  "size": 0,
  "aggs": {
    "log_query": {
      "filter": {
        "bool": {
          "must": [
            {
              "term": {
                "cluster": "giauht1"
              }
            },
            {
              "term": {
                "server": "hadoop0"
              }
            },
            {
              "term": {
                "type": "Warn"
              }
            },
            {
              "range": {
                "actionTime": {
                  "lte": "2015-02-24T00:00:00.000",
                  "gte": "2015-02-01T00:00:00.000"
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "histogram_Log": {
          "date_histogram": {
            "field": "actionTime",
            "interval": "1d",
            "format": "dd/MM/YYYY hh:mm:ss"
          }
        }
      }
    }
  }
}

编辑：

在回答您的评论时， filtered query filter和filter aggregation之间的区别在于前者在查询阶段开始时将过滤应用于所有文档，过滤器通常被缓存，从而提高了使用这些过滤器的后续查询的性能，同时后者适用于聚合范围，以将当前上下文中的文档过滤到单个存储桶。 如果您的查询仅用于执行聚合，并且您可能使用相同的过滤器运行聚合，我认为filtered query filter应该提供更好的性能。