Elasticsearch 查询不适用于大写字母的字段

Question

我已经using/mapping将字符串字段索引为：“not_analyzed”但仍然无法获得大写字母字符串的搜索结果??我彻底搜索了整个互联网，但没有简单的解决方法。

示例数据：

{
    "job_status":"Finished",
    "build_number":"94",
    "build_duration":778,
    "@timestamp":"1455317284293",
    "build_result":"UNSTABLE",
    "slave_node":"tiny-cmsbuild03",
    "job_name":"DMWM-WMCore-RunTests-Oracle"
},
{
    "job_status":"Finished",
    "build_number":"96",
    "build_duration":859,
    "@timestamp":"1455662929042",
    "build_result":"UNSTABLE",
    "slave_node":"tiny-cmsbuild02",
    "job_name":"DMWM-WMCore-RunTests-Oracle"
},
{
    "job_status":"Finished",
    "build_number":"89",
    "build_duration":385,
    "@timestamp":"1454453359226",
    "build_result":"UNSTABLE",
    "slave_node":"tiny-cmsbuild06",
    "job_name":"DMWM-WMCore-RunTests-Oracle"
}

kibana3 正在进行此查询：

"query": {
       "filtered": {
         "query": {
           "bool": {
             "should": [
               {
                  "query_string": {
                   "query": "job_name:D*"
                 }
               }
             ]
            }
          },
           "filter": {
             "bool": {
               "must": [
               {
                  "match_all": {}
               }
             ]
            }
           }
    }
  }

但是没有结果。

Answer 1

您没有得到任何结果的原因是 query_string query 有一个名为 lowercase_expanded_terms 的参数，默认情况下为 true。

它所做的是将您传递给它的查询字符串小写，以便 job_name:D* 变为 job_name:d*，因此没有匹配项。

但是，如果您这样查询，即通过将 lowercase_expanded_terms 设置为 false，它将起作用：

curl -XGET localhost:9200/your_index/_search?lowercase_expanded_terms=false&q=job_name:D*

Elasticsearch 查询不适用于大写字母的字段

Elasticsearch query not working on fields with capital letters

elasticsearch

kibana