sorting - ElasticSearch过滤器对排序的影响

Question

我在 Elasticsearch 中有一个奇怪的行为。在开始使用过滤器之前，我有一个查询:

查询不带过滤器

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "_facility": {
              "query": "error",
              "operator": "AND"
            }
          }
        },
        {
          "match": {
            "_application": {
              "query": "live",
              "operator": "AND"
            }
          }
        }
      ],
      "must_not": [],
      "should": []
    }
  },
  "from": 0,
  "size": 10,
  "sort": [
    {
      "created_at": {
        "sort_mode": null,
        "order": "desc",
        "missing": null,
        "ignore_unmapped": null
      }
    },
    {
      "_score": {
        "sort_mode": null,
        "order": null,
        "missing": null,
        "ignore_unmapped": null
      }
    }
  ]
}

然后我必须添加过滤器

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "_facility": {
              "query": "error",
              "operator": "AND"
            }
          }
        },
        {
          "match": {
            "_application": {
              "query": "live",
              "operator": "AND"
            }
          }
        }
      ],
      "must_not": [],
      "should": []
    }
  },
  "filter": {
    "and": {
      "filters": [
        {
          "range": {
            "created_at": {
              "from": 1373320800,
              "to": 1373493599,
              "include_lower": true,
              "include_upper": true
            },
            "_cache": true
          }
        }
      ]
    },
    "_cache": false
  },
  "from": 0,
  "size": 10,
  "sort": [
    {
      "created_at": {
        "sort_mode": null,
        "order": "desc",
        "missing": null,
        "ignore_unmapped": null
      }
    },
    {
      "_score": {
        "sort_mode": null,
        "order": null,
        "missing": null,
        "ignore_unmapped": null
      }
    }
  ]
}

我还有下一个问题:

1)结果未按created_at正确排序，看起来像是混洗的数据

2)大小-不考虑任何不同于10的自定义值(假设我要显示20 [或5]个记录，但我有10个)

感谢您的帮助。可能我在Elastic Search概念中缺少了一些东西。

Answer 1

问题在于"_cache": false过滤器中的and实际上在过滤器之外。它应该更深一层:

"filter": {
  "and": {
    "filters": [{
      "range": {
        "created_at": {
          "from": 1373320800,
          "to": 1373493599,
          "include_lower": true,
          "include_upper": true
        },
        "_cache": true
      }
    }],
    "_cache": false
  }
}

它抛出Elasticsearch解析器，并开始忽略其余查询。顺便说一句，这些_cache语句是无用的，因为它们只是确保了默认设置。正如@Damien所说，整个请求将比filtered查询好得多:

{
  "query": {
    "filtered": {
      "query": {
        "bool": {
          "must": [{
            "match": {
              "_facility": {
                "query": "error",
                "operator": "AND"
              }
            }
          }, {
            "match": {
              "_application": {
                "query": "live",
                "operator": "AND"
              }
            }
          }]
        }
      },
      "filter": {
        "and": {
          "filters": [{
            "range": {
              "created_at": {
                "from": 1373320800,
                "to": 1373493599,
                "include_lower": true,
                "include_upper": true
              },
              "_cache": true
            }
          }, {
            "match_all": {}
          }],
          "_cache": false
        }
      }
    }

  },
  "from": 0,
  "size": 10,
  "sort": [{
    "created_at": {
      "order": "desc"
    }
  }, {
    "_score": {}
  }]
}