Elasticsearch 前缀查询不适用于嵌套文档

Question

我正在为 elasticsearch 查询使用 prefix 查询。在顶层数据上使用它时效果很好，但一旦应用于嵌套数据，就不会返回任何结果。我尝试查询的数据如下所示:

prefix 查询在这里工作正常: 查询:

{ "query": { "prefix" : { "duration": "7"} } }

结果:

{
   "took": 25, ... },
   "hits": {
      "total": 6,
      "max_score": 1,
      "hits": [
         {
        "_index": "itemresults",
        "_type": "itemresult",
        "_id": "ITEM_RESULT_7c8649c2-6cb0-487e-bb3c-c4bf0ad28a90_8bce0a3f-f951-4a01-94b5-b55dea1a2752_7c965241-ad0a-4a83-a400-0be84daab0a9_61",
        "_score": 1,
        "_source": {
           "score": 1,
           "studentId": "61",
           "timestamp": 1377399320017,
           "groupIdentifiers": {},
           "assessmentItemId": "7c965241-ad0a-4a83-a400-0be84daab0a9",
           "answered": true,
           "duration": "7.078",
           "metadata": {
              "Korrektur": "a",
              "Matrize12_13": "MA.1.B.1.d.1",
              "Kompetenz": "ZuV",
              "Zyklus": "Z2",
              "Schwierigkeit": "H",
              "Handlungsaspekt": "AuE",
              "Fach": "MA",
              "Aufgabentyp": "L"
           },
           "assessmentSessionId": "7c8649c2-6cb0-487e-bb3c-c4bf0ad28a90",
           "assessmentId": "8bce0a3f-f951-4a01-94b5-b55dea1a2752"
        }
     },

现在尝试使用 prefix 查询应用于嵌套结构“元数据”不会返回任何结果:

{ "query": { "prefix" : { "metadata.Fach": "M"} } }

结果:

{
   "took": 18,
   "timed_out": false,
   "_shards": {
      "total": 15,
      "successful": 15,
      "failed": 0
   },
   "hits": {
      "total": 0,
      "max_score": null,
      "hits": []
   }
}

我做错了什么？是否可以对嵌套数据应用前缀？

Answer 1

与嵌套与否无关。这取决于您的映射，您是否在索引时分析字符串。

我举个例子:

我已经使用以下映射创建和索引:

curl -XPUT 'http://localhost:9200/test/' -d '
{
  "mappings": {

    "test" : {
      "properties" : {
        "text_1" : {
           "type" : "string",
           "index" : "analyzed"
        },
        "text_2" : {
          "index": "not_analyzed",
           "type" : "string"
        }
      }
    }
  }
}'

基本上是 2 个文本字段，一个已分析，另一个未分析。现在我索引以下文档:

curl -XPUT 'http://localhost:9200/test/test/1' -d '
{
"text_1" : "Hello world",
"text_2" : "Hello world"
}'

text_1 查询

在分析 text_1 时，elasticsearch 所做的一件事就是将字段转换为小写。因此，如果我进行以下查询，它不会找到任何文档:

curl -XGET 'http://localhost:9200/test/test/_search?pretty=true' -d '
{ "query": { "prefix" : { "text_1": "H"} } }
'
{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 0,
    "max_score" : null,
    "hits" : [ ]
  }
}

但如果我使用小写字母进行查询:

curl -XGET 'http://localhost:9200/test/test/_search?pretty=true' -d '
{ "query": { "prefix" : { "text_1": "h"} } }
'
{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 1,
    "max_score" : 1.0,
    "hits" : [ {
      "_index" : "test",
      "_type" : "test",
      "_id" : "1",
      "_score" : 1.0, "_source" :
{
"text_1" : "Hello world",
"text_2" : "Hello world"
}
    } ]
  }
}

text_2 查询

由于未分析 text_2，当我进行原始查询时它匹配:

curl -XGET 'http://localhost:9200/test/test/_search?pretty=true' -d '
{ "query": { "prefix" : { "text_2": "H"} } }
'
{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 1,
    "max_score" : 1.0,
    "hits" : [ {
      "_index" : "test",
      "_type" : "test",
      "_id" : "1",
      "_score" : 1.0, "_source" :
{
"text_1" : "Hello world",
"text_2" : "Hello world"
}
    } ]
  }
}