json - 弹性query_string返回不需要的值

标签 json elasticsearch

我正在尝试根据群集字段以及podName字段是否具有值进行过滤。
然后，我想过滤掉某些具有特定值的字段，但获得除指定的群集字段以外的其他值。
因此，以下查询还将返回cluster2和cluster3的值。
我不知道什么是正确的语法。

{
   "size":50,
   "query":{
      "bool":{
         "must":[
            {
               "range":{
                  "timestamp":{
                     "gte":"now-1h"
                  }
               }
            },
            {
               "query_string":{
                  "query":"(podstatus.podName:* AND cluster:cluster1) AND NOT podstatus.containerStatus:true AND NOT podstatus.phase:Running AND NOT podstatus.phase:Succeeded AND NOT podstatus.started: true"
               }
            }
         ]
      }
   }
}
样本文件
{
    "timestamp":  "2020-07-09T17:30:04",
    "cluster":  "cluster1",
    "namespace":  "kube-system",
    "podstatus.podName":  "cronjob-kubernetes-resource-monitor-1594233600-4frbc",
    "podstatus.containerStatus":  "false",
    "podstatus.restartCount":  0,
    "podstatus.started":  "false",
    "podstatus.phase":  "Succeeded"
}
制图
{
    "cluster-resources-cluster1-2020.07.08-000001" : {
      "mappings" : {
        "properties" : {
          "allocated" : {
            "properties" : {
              "pods-percent" : {
                "type" : "float"
              }
            }
          },
          "capacity" : {
            "properties" : {
              "cpu" : {
                "type" : "long"
              },
              "mem" : {
                "type" : "long"
              },
              "pods" : {
                "type" : "long"
              }
            }
          },
          "cluster" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "depstatus" : {
            "properties" : {
              "availableReplicas" : {
                "type" : "long"
              },
              "deploymentName" : {
                "type" : "text",
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              },
              "readyReplicas" : {
                "type" : "long"
              },
              "replicas" : {
                "type" : "long"
              },
              "unavailableReplicas" : {
                "type" : "long"
              },
              "updatedReplicas" : {
                "type" : "long"
              }
            }
          },
          "namespace" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "podstatus" : {
            "properties" : {
              "containerStatus" : {
                "type" : "text",
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              },
              "phase" : {
                "type" : "text",
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              },
              "podName" : {
                "type" : "text",
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              },
              "restartCount" : {
                "type" : "long"
              },
              "started" : {
                "type" : "text",
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              }
            }
          },
          "requests" : {
            "properties" : {
              "cpu" : {
                "type" : "long"
              },
              "cpu-percent" : {
                "type" : "float"
              },
              "mem" : {
                "type" : "long"
              },
              "mem-percent" : {
                "type" : "float"
              },
              "pods" : {
                "type" : "long"
              }
            }
          },
          "timestamp" : {
            "type" : "date"
          }
        }
      }
    }
  }

最佳答案

您的查询似乎工作正常。但是，我将发布以下步骤，如果您能以类似方式找到任何观察结果，请告诉我。
我已经完成了映射，创建了示例文档，您共享的查询以及得到的响应。
对应:

PUT cluster_index_001
{
  "mappings" : {
    "properties" : {
      "allocated" : {
        "properties" : {
          "pods-percent" : {
            "type" : "float"
          }
        }
      },
      "capacity" : {
        "properties" : {
          "cpu" : {
            "type" : "long"
          },
          "mem" : {
            "type" : "long"
          },
          "pods" : {
            "type" : "long"
          }
        }
      },
      "cluster" : {
        "type" : "text",
        "fields" : {
          "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256
          }
        }
      },
      "depstatus" : {
        "properties" : {
          "availableReplicas" : {
            "type" : "long"
          },
          "deploymentName" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "readyReplicas" : {
            "type" : "long"
          },
          "replicas" : {
            "type" : "long"
          },
          "unavailableReplicas" : {
            "type" : "long"
          },
          "updatedReplicas" : {
            "type" : "long"
          }
        }
      },
      "namespace" : {
        "type" : "text",
        "fields" : {
          "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256
          }
        }
      },
      "podstatus" : {
        "properties" : {
          "containerStatus" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "phase" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "podName" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "restartCount" : {
            "type" : "long"
          },
          "started" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          }
        }
      },
      "requests" : {
        "properties" : {
          "cpu" : {
            "type" : "long"
          },
          "cpu-percent" : {
            "type" : "float"
          },
          "mem" : {
            "type" : "long"
          },
          "mem-percent" : {
            "type" : "float"
          },
          "pods" : {
            "type" : "long"
          }
        }
      },
      "timestamp" : {
        "type" : "date"
      }
    }
  }
}
样本文件:
POST cluster_index_001/_doc/1
{
    "timestamp":  "2020-07-09T17:30:04",
    "cluster":  "cluster1",
    "namespace":  "kube-system",
    "podstatus.podName":  "cronjob-kubernetes-resource-monitor-1594233600-4frbc",
    "podstatus.containerStatus":  "false",
    "podstatus.restartCount":  0,
    "podstatus.started":  "false",
    "podstatus.phase":  "Failed"
}

POST cluster_index_001/_doc/2
{
    "timestamp":  "2020-07-10T17:30:04",
    "cluster":  "cluster1",
    "namespace":  "kube-system",
    "podstatus.podName":  "cronjob-kubernetes-resource-monitor-1594233600-4frbc",
    "podstatus.containerStatus":  "false",
    "podstatus.restartCount":  0,
    "podstatus.started":  "false",
    "podstatus.phase":  "Failed"
}

POST cluster_index_001/_doc/3
{
    "timestamp":  "2020-07-10T17:30:04",
    "cluster":  "cluster2",
    "namespace":  "kube-system",
    "podstatus.podName":  "cronjob-kubernetes-resource-monitor-1594233600-4frbc",
    "podstatus.containerStatus":  "false",
    "podstatus.restartCount":  0,
    "podstatus.started":  "false",
    "podstatus.phase":  "Failed"
}
查询样例:
POST cluster_index_001/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "timestamp": {
              "gte": "now-2d"
            }
          }
        },
        {
          "query_string": {
            "query":"(podstatus.podName:* AND cluster:cluster1) AND NOT podstatus.containerStatus:true AND NOT podstatus.phase:Running AND NOT podstatus.phase:Succeeded AND NOT podstatus.started:true"
          }
        }
      ]
    }
  }
}
您也可以像上面的cluster.keyword一样使用上面的cluster.keyword:cluster1进行精确匹配。
响应:
{
  "took" : 86,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 2,
      "relation" : "eq"
    },
    "max_score" : 2.4700036,
    "hits" : [
      {
        "_index" : "cluster_index_001",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 2.4700036,
        "_source" : {
          "timestamp" : "2020-07-09T17:30:04",
          "cluster" : "cluster1",
          "namespace" : "kube-system",
          "podstatus.podName" : "cronjob-kubernetes-resource-monitor-1594233600-4frbc",
          "podstatus.containerStatus" : "false",
          "podstatus.restartCount" : 0,
          "podstatus.started" : "false",
          "podstatus.phase" : "Failed"
        }
      },
      {
        "_index" : "cluster_index_001",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 2.4700036,
        "_source" : {
          "timestamp" : "2020-07-10T17:30:04",
          "cluster" : "cluster1",
          "namespace" : "kube-system",
          "podstatus.podName" : "cronjob-kubernetes-resource-monitor-1594233600-4frbc",
          "podstatus.containerStatus" : "false",
          "podstatus.restartCount" : 0,
          "podstatus.started" : "false",
          "podstatus.phase" : "Failed"
        }
      }
    ]
  }
}
请注意查询正常工作并返回正确的文档集
其他调试和更多信息:
此步骤将帮助您进行验证，并让您知道为什么不应该返回的文档正在返回。
例如，对于我来说，样本中的第3个文档没有出现在响应中，而找出该问题的方法是利用Explain API.
GET cluster_index_001/_explain/3       <----- Note this
{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "timestamp": {
              "gte": "now-2d"
            }
          }
        },
        {
          "query_string": {
              "query":"podstatus.podName:* AND cluster:cluster1 AND NOT podstatus.containerStatus:true AND NOT podstatus.phase:Running AND NOT podstatus.started: true"
          }
        }
      ]
    }
  }
}
我看到的响应如下:
{
  "_index" : "cluster_index_001",
  "_type" : "_doc",
  "_id" : "3",
  "matched" : false,
  "explanation" : {
    "value" : 0.0,
    "description" : "Failure to meet condition(s) of required/prohibited clause(s)",
    "details" : [
      {
        "value" : 1.0,
        "description" : "ConstantScore(DocValuesFieldExistsQuery [field=timestamp])",
        "details" : [ ]
      },
      {
        "value" : 0.0,
        "description" : "no match on required clause (+ConstantScore(NormsFieldExistsQuery [field=podstatus.podName]) +cluster:cluster1 -podstatus.containerStatus:true -podstatus.phase:running -podstatus.started:true)",
        "details" : [
          {
            "value" : 0.0,
            "description" : "Failure to meet condition(s) of required/prohibited clause(s)",
            "details" : [
              {
                "value" : 1.0,
                "description" : "ConstantScore(NormsFieldExistsQuery [field=podstatus.podName])",
                "details" : [ ]
              },
              {
                "value" : 0.0,
                "description" : "no match on required clause (cluster:cluster1)",
                "details" : [
                  {
                    "value" : 0.0,
                    "description" : "no matching term",
                    "details" : [ ]
                  }
                ]
              }
            ]
          }
        ]
      }
    ]
  }
}
请注意，以上响应中的描述如何清楚地说明这一点:
"description" : "Failure to meet condition(s) of required/prohibited clause(s)"
另请注意以下几点:
"description" : "no match on required clause (+ConstantScore(NormsFieldExistsQuery [field=podstatus.podName]) +cluster:cluster1 -podstatus.containerStatus:true -podstatus.phase:running -podstatus.started:true)",
结果，您现在知道了为什么文档3没有返回响应。
此外，如果仍然无法解决问题，请确保以下几点:
  • 确保您没有使用任何别名，并且一次只关注单个索引。如果使用别名，请缩小可能导致此问题的索引。
  • 还请确保您所讨论的文档中没有多个值，例如"cluster": "cluster2, cluster1"
  • 如果以上两点都清楚，请转到浏览器并键入http://<your_host_name>:<port>/cluster-resources-cluster1-2020.07.08-000001/_settings，然后观察是否有针对以下目的实现的自定义分析器: Edge Ngrams或Ngrams，以及您的standard分析器是否已被覆盖。
  • 执行此http://<your_host_name>:<port>/cluster-resources-cluster1-2020.07.08-000001/_stats?pretty，并注意是否发现任何奇怪的东西。

    • 一次做一件事，请分享您的看法，我们可以看到问题所在。

    关于json - 弹性query_string返回不需要的值，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/62819546/

    上一篇：java - 如何测试返回复杂对象的函数？

    下一篇：elasticsearch - 什么是constant_score，没有术语

    相关文章：

    ios - 如何从这个 JSON 数组中提取这个特定节点？

    JavaScript 访问对象

    elasticsearch - 为了在聚合中获得成功，在elasticsearch中

    elasticsearch - ElasticSearch:层次结构级别数据的设计模式？

    c# - 如何使用 C# 的 Nest Elasticsearch 编写查询？

    java - 如何处理在 socket java 上发送的大对象？

    jquery - 错误: jQuery . ..未被调用——Ajax从Node.js跨域服务器请求geoJSON

    azure - 增加 kubernetes 中 statefulset 的 PVC 大小

    elasticsearch - Elasticsearch 节点断开连接

    javascript - API 调用不会返回数组中的所有对象

    ©2024 IT工具网  联系我们