elasticsearch - elasticsearch排序搜索返回中的_doc是什么意思？

Question

当我使用 _search 函数在 elasitcsearch 中进行排序时，我在排序字段中得到了 _doc。它与作为文档类型的 _doc 字段有什么区别？

Elasticseach 版本:6.2.2

"sort": [
    1577413214250, # timestamp
    393 # _doc
  ]

实际上，kibana 在实现“Surrounding Documents”时也使用了_doc:

{"index":["prophet-job-*"],"ignore_unavailable":true,"preference":1577428415532}
{"version":true,"size":5,"search_after":[1577413214250,385],"sort":[{"@timestamp":{"order":"asc","unmapped_type":"boolean"}},{"_doc":{"order":"desc","unmapped_type":"boolean"}}],"_source":{"excludes":[]},"stored_fields":["*"],"script_fields":{},"docvalue_fields":["@timestamp"],"query":{"bool":{"must":[{"match_all":{}}],"filter":[],"should":[],"must_not":[]}}}
{"index":["prophet-job-*"],"ignore_unavailable":true,"preference":1577428415532}
{"version":true,"size":5,"search_after":[1577413214250,385],"sort":[{"@timestamp":{"order":"desc","unmapped_type":"boolean"}},{"_doc":{"order":"asc","unmapped_type":"boolean"}}],"_source":{"excludes":[]},"stored_fields":["*"],"script_fields":{},"docvalue_fields":["@timestamp"],"query":{"bool":{"must":[{"match_all":{}}],"filter":[],"should":[],"must_not":[]}}}

Answer 1

_doc 在排序的上下文中可以使用，如果您不关心顺序，并且只是希望以最有效的方式返回文档。将其视为搜索选项，而不是索引文档类型“_doc”

有关按 _doc 排序的更多信息，请参阅官方 documentation 。

嗨，丹尼斯，下面是一个简单的示例:http://test.kibana.some.net/elasticsearch/_msearch
请求支付:

{"index":["some-index-*"],"ignore_unavailable":true,"preference":1577931761749}
{"version":true,"size":5,"search_after":[1577931865123,12],"sort":[{"@timestamp":{"order":"asc","unmapped_type":"boolean"}},{"_doc":{"order":"desc","unmapped_type":"boolean"}}],"_source":{"excludes":[]},"stored_fields":["*"],"script_fields":{},"docvalue_fields":["@timestamp"],"query":{"bool":{"must":[{"match_all":{}}],"filter":[],"should":[],"must_not":[]}}}
{"index":["some-index-*"],"ignore_unavailable":true,"preference":1577931761749}
{"version":true,"size":5,"search_after":[1577931865123,12],"sort":[{"@timestamp":{"order":"desc","unmapped_type":"boolean"}},{"_doc":{"order":"asc","unmapped_type":"boolean"}}],"_source":{"excludes":[]},"stored_fields":["*"],"script_fields":{},"docvalue_fields":["@timestamp"],"query":{"bool":{"must":[{"match_all":{}}],"filter":[],"should":[],"must_not":[]}}}

部分响应是

{
  "_index": "some-index-2020.01.02",
  "_type": "doc",
  "_id": "123456",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2020-01-02T02:24:25.123Z",
    "prospector": {
      "type": "log"
    },
    "@version": "1",
    "tags": [
      "beats_input_codec_plain_applied"
    ],
    "fields": {
      "some-values": "xxxxxx"
    },
    "message": "[2020-01-02 10:24:24] [INFO] [evaluation.py:277] Finished evaluation at 2020-01-02-02:24:24"
  },
  "fields": {
    "@timestamp": [
      "2020-01-02T02:24:25.123Z"
    ]
  },
  "sort": [
    1577931865123,
    11 # this is _doc value
  ]
}

我第二次搜索相同的东西时，除了_doc值更改为12之外，响应具有相同的内容，所以我对这个字段的定义感到困惑。