elasticsearch - 为什么es通过查询删除会删除更多记录

Question

es中有以下数据

"id":1, "platform":"sougou_wechat", "screen_name":"aaa", "created_at":1530028800000
"id":2, "platform":"sougou_wechat", "screen_name":"bbb", "created_at":1530028800000
"id":3, "platform":"sougou_wechat", "screen_name":"ccc", "created_at":1530028800000
"id":4, "platform":"sougou_wechat", "screen_name":"aaa", "created_at":1529942400000

现在我要删除[aaa，bbb]中screen_name的记录

curl -XGET '127.0.0.1:9200/test/_search?pretty' -H 'Content-Type: application/json' -d'
{
    "query": { "bool": {"must" : [{"match":{"platform":"sougou_wechat"}}] , "filter" : { "terms" : { "screen_name" : ["aaa", "bbb"] } }, "filter":[{"range":{"created_at":{"gte":1530028800000,"lt":1530115200000} }}] } }
}
'
{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 2,
    "max_score" : 0.2876821,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "foo",
        "_id" : "2",
        "_score" : 0.2876821,
        "_source" : {
          "id" : 2,
          "platform" : "sougou_wechat",
          "screen_name" : "bbb",
          "created_at" : 1530028800000
        }
      },
      {
        "_index" : "test",
        "_type" : "foo",
        "_id" : "1",
        "_score" : 0.2876821,
        "_source" : {
          "id" : 1,
          "platform" : "sougou_wechat",
          "screen_name" : "aaa",
          "created_at" : 1530028800000
        }
      }
    ]
  }
}

它确实返回了我要删除的two记录，但是当我使用相同的查询执行delete_by_query时，为什么删除three记录？似乎第二个过滤器不起作用，因为只剩下第四条记录。

➜  ~ curl -X POST "127.0.0.1:9200/test/_delete_by_query?pretty" -H 'Content-Type: application/json' -d'
quote> {
quote> "query": { "bool": {"must" : [{"match":{"platform":"sougou_wechat"}}] , "filter" : { "terms" : { "screen_name" : ["aaa", "bbb"] } }, "filter":[{"range":{"created_at":{"gte":1530028800000,"lt":1530115200000} }}] } }
quote> }
quote> '
{
  "took" : 210,
  "timed_out" : false,
  "total" : 3,
  "deleted" : 3,
  "batches" : 1,
  "version_conflicts" : 0,
  "noops" : 0,
  "retries" : {
    "bulk" : 0,
    "search" : 0
  },
  "throttled_millis" : 0,
  "requests_per_second" : -1.0,
  "throttled_until_millis" : 0,
  "failures" : [ ]
}

ps下面的查询可以正确删除两条记录

"query": {
    "bool": {
        "must": [{
            "match": {
                "platform": "sougou_wechat"
            }
        }, {
            "terms": {
                "screen_name": ["aaa", "bbb"]
            }
        }, {
            "range": {
                "created_at": {
                    "gte": 1530028800000,
                    "lt": 1530115200000
                }
            }
        }]
    }
}

ps

➜  ~ curl 'http://192.168.0.25:9200/test/_validate/query?explain=true&pretty' -H 'Content-Type: application/json' -d'
quote> {
quote>     "query": { "bool": {"must" : [{"match":{"platform":"sougou_wechat"}}] , "filter" : { "terms" : { "screen_name" : ["aaa", "bbb"] } }, "filter":[{"range":{"created_at":{"gte":1530028800000,"lt":1530115200000} }}] } }
quote> }
quote> '
{
  "valid" : true,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "failed" : 0
  },
  "explanations" : [
    {
      "index" : "test",
      "valid" : true,
      "explanation" : "+platform:sougou_wechat #screen_name:aaa screen_name:bbb #created_at:[1530028800000 TO 1530115199999]"
    }
  ]
}

和我使用的版本

  "version" : {
    "number" : "5.5.2",
    "build_hash" : "b2f0c09",
    "build_date" : "2017-08-14T12:33:14.154Z",
    "build_snapshot" : false,
    "lucene_version" : "6.6.0"
  },

Answer 1

您的查询不正确，您有两次bool/filter，第二次(带有范围)将覆盖第一次(带有屏幕名称)

这是您需要使用的正确查询:

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "platform": "sougou_wechat"
          }
        }
      ],
      "filter": [
        {
          "terms": {
            "screen_name": [
              "aaa",
              "bbb"
            ]
          }
        },
        {
          "range": {
            "created_at": {
              "gte": 1530028800000,
              "lt": 1530115200000
            }
          }
        }
      ]
    }
  }
}