Elasticsearch -使用"keyword“类型搜索不起作用
Elasticsearch -使用"keyword“类型搜索不起作用
提问于 2018-02-01 15:20:44
我使用的是Elasticsearch Java rest client 6.1。当我试图查找日志时，由于一些参数，而不是在一个字段中，我什么也得不到。
下面是我的代码：
@Override
public SearchResponse findLogsByValues(ElasticSearchLogRequest esLogRequest, Pageable pageable) {
SearchRequest searchRequest = new SearchRequest("portal-logs-*");
SearchSourceBuilder sourceBuilder = new SearchSourceBuilder();
BoolQueryBuilder bqb = QueryBuilders.boolQuery();
if (esLogRequest.getLevels() != null) {
Iterator<String> iterator = esLogRequest.getLevels().iterator();
int counter = 0;
SpanOrQueryBuilder spanOrQueryBuilder = null;
while (iterator.hasNext()) {
if (counter == 0) {
spanOrQueryBuilder = new SpanOrQueryBuilder(QueryBuilders.
spanTermQuery("level", iterator.next().toLowerCase()));
} else {
spanOrQueryBuilder.addClause(QueryBuilders.
spanTermQuery("level", iterator.next().toLowerCase()));
}
counter++;
}
bqb.filter(spanOrQueryBuilder);
}
try {
searchResponse = client.search(searchRequest);
} catch (IOException e) {
e.printStackTrace();
}
return searchResponse;
}下面是我的json请求：
{
"levels": ["TRACE","INFO"]
}下面是在ES中log(object)的样子：
{
"code": 200,
"error": "",
"message": "",
"data": {
"content": [
{
"level": "INFO",
"module": "test module",
"ip": "192.168.3.93",
"thread": "test thread",
"sessionId": "1",
"office": "1",
"message": "test message 3",
"userName": "user",
"timeStamp": "2018-01-25T08:02:50.000Z",
"userLogin": "user",
"node": "first node",
"system": "super system 1",
"port": 9300,
"header": "test Header",
"submodule": "test submodule",
"location": {
"lon": -71.34,
"lat": 41.12
},
"operation": "some operation",
"device": "some device"
}
],
"totalPages": 1,
"last": true,
"totalElements": 0,
"size": 0,
"number": 0,
"sort": null,
"first": true,
"numberOfElements": 0
}
}这是我的映射模板：
PUT _template/portal-logs
{
"template": "portal-logs-*",
"settings": { "number_of_shards": 5 },
"mappings": {
"logs_info": {
"_all": {
"enabled": false
},
"properties": {
"device": {"type": "keyword"},
"header": {"type": "text"},
"ip": {"type": "keyword"},
"level": {"type": "keyword"},
"location": {"type": "geo_point"},
"message": {"type": "text"},
"module": {"type": "keyword"},
"node": {"type": "keyword"},
"office": {"type": "keyword"},
"operation": {"type": "keyword"},
"port": {"type": "integer"},
"sessionId": {"type": "keyword"},
"submodule": {"type": "keyword"},
"system": {"type": "keyword"},
"thread": {"type": "keyword"},
"timeStamp": {"type": "date"},
"userLogin": {"type": "keyword"},
"userName": {"type": "keyword"}
}
}
}
}因此，当在映射字段"level“中将其设置为"text”时-它工作得很好，但当我设置"keyword“时-我收到一个空的json。我需要"level“字段有一个严格的”关键字“类型，当我想要获得所有有"level”、"INFO“或"TRACE”的日志时，它必须工作。在这种情况下，我该怎么办？为什么关键字不起作用？
回答 1
Stack Overflow用户
回答已采纳
发布于 2018-02-01 17:54:41
通过使用keyword类型，您的字段将不会被分析，并且需要与您的搜索词进行精确匹配，包括区分大小写。如果将字段类型设置为text，则将对其进行分析，在默认分析器下，这将使搜索不区分大小写。
此外，除非您的level字段包含多个术语，否则您应该能够使用TermsQuery搜索多个值。例如( DSL格式)：
GET _search
{
"query": {
"terms": {
"level": [ "INFO", "TRACE" ]
}
}
}页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/48566155
复制相关文章
相似问题
腾讯云开发者
