elasticsearch - Elasticsearch查找日期使用范围查询相交和内部

标签 elasticsearch kibana elastic-stack elasticsearch-5 elk

我在Elasticsearch中的列表

[{
  "index1": [{
    "hour_start": "2020-03-17 14:00:00",
    "hour_end": "2020-03-17 15:00:00"
  }]
}, {
  "index2": [{
    "hour_start": "2020-03-17 10:00:00",
    "hour_end": "2020-03-17 07:00:00"
  }, {
    "hour_start": "2020-03-18 10:00:00",
    "hour_end": "2020-03-18 07:00:00"
  }]
}, {
  "index3": [{
    "hour_start": "2020-03-17 13:00:00",
    "hour_end": "2020-03-17 10:00:00"
  }]
}, {
  "index4": [{
    "hour_start": "2020-03-17 09:00:00",
    "hour_end": "2020-03-17 04:00:00"
  }]
}]

如何在范围“2020-03-17 06:00:00”至“2020-03-17 12:00:00”内查找并相交的获取列表?

期望输出:
[{
  "index2": [{
    "hour_start": "2020-03-17 10:00:00",
    "hour_end": "2020-03-17 07:00:00"
  }, {
    "hour_start": "2020-03-18 10:00:00",
    "hour_end": "2020-03-18 07:00:00"
  }]
}, {
  "index3": [{
    "hour_start": "2020-03-17 13:00:00",
    "hour_end": "2020-03-17 10:00:00"
  }]
}, {
  "index4": [{
    "hour_start": "2020-03-17 09:00:00",
    "hour_end": "2020-03-17 04:00:00"
  }]
}]

我厌倦了在列表中找到相交,我在elasticsearch中不知道逻辑或不同于编程语言流程

最佳答案

字段类型必须从对象类型更改为nested type。这将允许将数组中的属性视为单独的索引

我已经使用must [AND]子句来涵盖以下情况

       <-----row 1 interval------->

<-找到这个-> <-这个-> <-这个->

对应:
{
  "mappings": {
    "properties": {
      "time": {
        "type": "nested", ---> note type
        "properties": {
          "hour_end": {
            "type": "date",
            "format": "yyyy-MM-dd HH:mm:ss"
          },
          "hour_start": {
            "type": "date",
            "format": "yyyy-MM-dd HH:mm:ss"
          }
        }
      }
    }
  }
}

查询:
{
  "query": {
    "nested": {
      "path": "time",
      "query": {
        "bool": {
          "must": [ 
            {
              "range": {
                "time.hour_start": {
                  "lte": "2020-03-17 10:00:00"
                }
              }
            },
            {
              "range": {
                "time.hour_end": {
                  "gte": "2020-03-17 04:00:00"
                }
              }
            }
          ]
        }
      },
      "inner_hits": {} --> to get objects in array which match
    }
  }
}

关于elasticsearch - Elasticsearch查找日期使用范围查询相交和内部,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/60629524/

相关文章:

elasticsearch - 为什么 Painless 编译器会提示 `new` 关键字?

Elasticsearch:聚合查询结果

elasticsearch - 加载许多数据后,Elasticsearch无法启动

elasticsearch - Elasticsearch-小于-1个字节的值不受查询节点支持

angular - 如何在iframe中的Kibana仪表板中绕过登录

elasticsearch - FileBeat收集问题

elasticsearch - elasticsearch架构/开发查询-ADFS/安全过滤/SearchUI

elasticsearch - 如何向标准 token 生成器添加其他分隔符?

elasticsearch - Kibana Dashboard only 模式

elasticsearch - 如何防止旧日志从文件拍追加到Logstash?