使用OR和通配符查詢Elasticsearch

Question

我試圖對我的elasticsearch _type做一個簡單的查詢，並用通配符匹配多個字段，我的第一次嘗試是這樣的：

POST my_index/my_type/_search
{
  "sort" : { "date_field" : {"order" : "desc"}},
  "query" : {
    "filtered" : {
      "filter" : {
        "or" : [
          {
              "term" : { "field1" : "4848" }
          },
          {
              "term" : { "field2" : "6867" }
          }
        ]
      }
    }
  }
}

當field1或field2分別分別等於4848和6867時，此示例將成功匹配每個記錄。

我想做的是在field1上匹配任何包含4848的文本和field6包含6867的文本，但是我不確定如何執行此操作。

我感謝我能得到的任何幫助:)

Answer 1

聽起來您的問題主要與分析有關 。 適當的解決方案取決於您的數據結構和要匹配的內容。 我將提供一些示例。

首先，假設您的數據足以使我們僅使用標准分析儀就可以得到想要的數據。 該分析器將標記空白，標點和符號上的文本字段。 因此，文本"1234-5678-90"將分為術語"1234" ， "5678"和"90" ，因此針對任何這些術語的"term"查詢或過濾器都將與該文檔匹配。 更具體地說：

DELETE /test_index

PUT /test_index
{
   "settings": {
      "number_of_shards": 1
   },
   "mappings": {
       "doc": {
           "properties": {
               "field1":{
                   "type": "string",
                   "analyzer": "standard"
               },
               "field2":{
                   "type": "string",
                   "analyzer": "standard"
               }
           }
       }
   }
}

POST /test_index/_bulk
{"index":{"_index":"test_index","_type":"doc","_id":1}}
{"field1": "1212-2323-4848","field2": "1234-5678-90"}
{"index":{"_index":"test_index","_type":"doc","_id":2}}
{"field1": "0000-0000-0000","field2": "0987-6543-21"}
{"index":{"_index":"test_index","_type":"doc","_id":3}}
{"field1": "1111-2222-3333","field2": "6867-4545-90"}

POST test_index/_search
{
   "query": {
      "filtered": {
         "filter": {
            "or": [
               {
                  "term": { "field1": "4848" }
               },
               {
                  "term": { "field2": "6867" }
               }
            ]
         }
      }
   }
}
...
{
   "took": 3,
   "timed_out": false,
   "_shards": {
      "total": 1,
      "successful": 1,
      "failed": 0
   },
   "hits": {
      "total": 2,
      "max_score": 1,
      "hits": [
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "1",
            "_score": 1,
            "_source": {
               "field1": "1212-2323-4848",
               "field2": "1234-5678-90"
            }
         },
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "3",
            "_score": 1,
            "_source": {
               "field1": "1111-2222-3333",
               "field2": "6867-4545-90"
            }
         }
      ]
   }
}

（明確地寫"analyzer": "standard"是多余的，因為如果您不指定它，則它是默認的分析器；我只是想讓它變得顯而易見。）

另一方面，如果以某種方式嵌入文本，以至於標准分析無法提供您想要的內容，請說"121223234848"而您想匹配"4848" ，則您將不得不做更多的事情復雜，使用ngrams 。 這是一個示例（請注意數據中的差異）：

DELETE /test_index

PUT /test_index
{
   "settings": {
      "analysis": {
         "filter": {
            "nGram_filter": {
               "type": "nGram",
               "min_gram": 2,
               "max_gram": 20,
               "token_chars": [
                  "letter",
                  "digit",
                  "punctuation",
                  "symbol"
               ]
            }
         },
         "analyzer": {
            "nGram_analyzer": {
               "type": "custom",
               "tokenizer": "whitespace",
               "filter": [
                  "lowercase",
                  "asciifolding",
                  "nGram_filter"
               ]
            },
            "whitespace_analyzer": {
               "type": "custom",
               "tokenizer": "whitespace",
               "filter": [
                  "lowercase",
                  "asciifolding"
               ]
            }
         }
      }
   },
   "mappings": {
      "doc": {
          "properties": {
               "field1":{
                   "type": "string",
                   "index_analyzer": "nGram_analyzer", 
                   "search_analyzer": "whitespace_analyzer"
               },
               "field2":{
                   "type": "string",
                   "index_analyzer": "nGram_analyzer", 
                   "search_analyzer": "whitespace_analyzer"
               }
           }
      }
   }
}

POST /test_index/_bulk
{"index":{"_index":"test_index","_type":"doc","_id":1}}
{"field1": "121223234848","field2": "1234567890"}
{"index":{"_index":"test_index","_type":"doc","_id":2}}
{"field1": "000000000000","field2": "0987654321"}
{"index":{"_index":"test_index","_type":"doc","_id":3}}
{"field1": "111122223333","field2": "6867454590"}


POST test_index/_search
{
   "query": {
      "filtered": {
         "filter": {
            "or": [
               {
                  "term": { "field1": "4848" }
               },
               {
                  "term": { "field2": "6867" }
               }
            ]
         }
      }
   }
}
...
{
   "took": 8,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 2,
      "max_score": 1,
      "hits": [
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "1",
            "_score": 1,
            "_source": {
               "field1": "121223234848",
               "field2": "1234567890"
            }
         },
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "3",
            "_score": 1,
            "_source": {
               "field1": "111122223333",
               "field2": "6867454590"
            }
         }
      ]
   }
}

這里發生了很多事情，所以我不會嘗試在這篇文章中解釋它。 如果您需要更多說明，建議您閱讀此博客文章： http : //blog.qbox.io/multi-field-partial-word-autocomplete-in-elasticsearch-using-ngrams 。 希望您能原諒無恥的外表。 ;）

希望能有所幫助。