ElasticSearch：查询帖子正文不起作用，但 uri 搜索工作

Question

我正在发送以下弹性搜索查询，它在通过 uri-search 发送时表现得非常好。但是对于带有身体呼叫的帖子 - 它无法按预期工作。请建议如何更正查询。

这行得通：

接听电话

<someUrl>/elasticsearch/index/_search?q=host:host-0

响应（仅限于 host-0）

{
    "took": 4,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "failed": 0
    },
    "hits": {
        "total": 128040,
        "max_score": 2.0973763,
        "hits": [{
                "_index": "123"
                "_type": "log_message",
                "_id": "123",
                "_score": 111,
                "_source": {
                    "host": "host-0",
                    "pid": 333,
                    "timestamp": "2017-04-06T04:29:44.724Z",
                    "priority": 7,
                    "namespace": "syslog",
                    "msg": "aaaaa"
                }
            },

            "_index": "345"
            "_type": "log_message",
            "_id": "345",
            "_score": 111,
            "_source": {
                "host": "host-0",
                "pid": 333,
                "timestamp": "2017-04-06T04:29:44.724Z",
                "priority": 7,
                "namespace": "syslog",
                "msg": "aaaaa"
            }
        }, 
        .....
}

这不起作用：

发布电话

<someUrl>/elasticsearch/index/_search

POST 调用的正文：

{
    "query" : {
        "term" : { "host": "host-0" }
    }
}

RESPONSE（不限于 host-0）

{
    "took": 4,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "failed": 0
    },
    "hits": {
        "total": 128040,
        "max_score": 2.0973763,
        "hits": [{
                "_index": "123"
                "_type": "log_message",
                "_id": "123",
                "_score": 111,
                "_source": {
                    "host": "host-1",
                    "pid": 333,
                    "timestamp": "2017-04-06T04:29:44.724Z",
                    "priority": 7,
                    "namespace": "syslog",
                    "msg": "aaaaa"
                }
            },

            "_index": "345"
            "_type": "log_message",
            "_id": "345",
            "_score": 111,
            "_source": {
                "host": "host-0",
                "pid": 333,
                "priority": 7,
                "namespace": "syslog",
                "msg": "aaaaa"
            }
        }, 
            "_index": "546"
            "_type": "log_message",
            "_id": "546",
            "_score": 111,
            "_source": {
                "host": "host-0",
                "pid": 222,                 
                "priority": 7,
                "namespace": "syslog",
                "msg": "aaaaa"
            }
        }, 
        .....
}

此索引上的 Get 返回 获取 /elasticsearch/

      "host": {
        "type": "string", 
        "index": "not_analyzed"
      },

Answer 1

在您的 GET 调用中，会分析令牌 host-0。如果您尝试以下 GET 调用（通过用双引号将 host-0 括起来），您将获得与 POST 调用相同的查询，但不会得到任何结果。

<someUrl>/elasticsearch/index/_search?q=host:"host-0"

如果您想要结果，您需要使用match 查询而不是term 查询。这将等同于您的 GET 调用中的 ...?q=host:host-0。

{
    "query" : {
        "match" : { "host": "host-0" }
    }
}

最后我认为您的host 字段具有text 类型，而它应该具有keyword 类型。