elasticsearch - 使用 'and'和 'or'进行过滤的elasticsearch语法错误

Question

我正在尝试使用elasticsearch执行过滤器，并且收到了我似乎无法纠正的语法错误。我已经测试了各个类，它们似乎运行良好。我究竟做错了什么？

这里的目的是查找同时满足三个条件的文档:(field1 == VAL1)，(field2 == VAL2)和((field3 == VAL3) || (field3 == VAL4))。

我收到的消息是:

"nested: QueryParsingException[[xxxx] Failed to parse]; nested: JsonParseException[Unexpected character (':' (code 58)): was expecting comma to separate ARRAY entries\n at [Source: [B@1acfee60; line: 13, column: 26]]; }]","status":400}"

谢谢!

curl -XGET 'localhost:9200/xxxx/yyyy/_search' -d '
{
    "query":
    {
        "filtered":
        {
            "filter":
            {
                "and":
                [
                    { "term": { "field1":"VAL1" } },
                    { "term": { "field2":"VAL2" } },
                    "or":
                    [
                        { "term": { "field3":"VAL3" } },
                        { "term": { "field3":"VAL4" } }
                    ]
                ]
            }
        }
    }
}
'

多亏了Paige Cook，语法错误现在消失了(见下文)。但是过滤器仍然与文档不匹配。而且我分别测试了“和”子句和“或”子句，它们都可以工作。我糊涂了。

curl -XGET 'localhost:9200/xxxx/users/_search' -d '
{
    "query":
    {
        "filtered":
        {
            "filter":
            {
                "and":
                [
                    { "term": { "field1":"VAL1" } },
                    { "term": { "field2":"VAL2" } }
                ],
                "or":
                [
                    { "term": { "field3":"VAL3" } },
                    { "term": { "field3":"VAL4" } }
                ]
            }
        }
    }
}
'

非常感谢Geert-Jan。最后的工作示例是:

curl -XGET 'localhost:9200/xxxx/yyyy/_search' -d '
{
    "query":
    {
        "filtered":
        {
            "filter":
            {
                "and":
                [
                    { "term": { "field1":"VAL1" } },
                    { "term": { "field2":"VAL2" } },
                    {
                        "or":
                        [
                            { "term": { "field3":"VAL3" } },
                            { "term": { "field3":"VAL4" } }
                        ]
                    }
                ]
            }
        }
    }
}
'

Answer 1

小心括号!

在这种情况下，基本过滤器只能包含1个过滤器and。在该复合过滤器中，您应该有2个基本过滤器(term)和一个复合过滤器or。

在这里(未经测试)

curl -XGET 'localhost:9200/xxxx/users/_search' -d '
{
    "query":
    {
        "filtered":
        {
            "filter":
            {
                "and":
                [
                    { "term": { "field1":"VAL1" } },
                    { "term": { "field2":"VAL2" } },
                    {
                        "or":
                        [
                            { "term": { "field3":"VAL3" } },
                            { "term": { "field3":"VAL4" } }
                        ]
                    }
                ]
            }
        }
    }
}