如果字段包含某些特定字符串，则搜索 Elasticsearch 2.4

Question

使用elasticsearch 2.4.1版，lucene 5.5.2版。

我面临的问题是我有如下文件：

{
                "_index": "_myIndex",
                "_type": "_mytype",
                "_id": "76be12a4-037d-45e2-8941-8228287fcae4",
                "_source": {
                    "eventID": "76be12a4-037d-45e2-8941-8228287fcae4",
                    "receivedTimestamp": 1497591418899,
                    "producerName": "_myProducer",
                    "eventName": "event1",
                    "message": "This is a query regarding elasticsearch. Return me this document if it contains elasticsearch",
                    "timestamp": "1497591418000"
                }
}

当我使用以下查询进行搜索时，我没有得到文档，而是看到了

curl -XGET 'http://localhost:9200/_myIndex/_search?pretty' -H 'Content-Type: application/json' -d '{ "query": { "match": { "message": "elasticsearch" }}}'

Returns:
{
  "took" : 8,
  "timed_out" : false,
  "_shards" : {
    "total" : 10,
    "successful" : 10,
    "failed" : 0
  },
  "hits" : {
    "total" : 0,
    "max_score" : null,
    "hits" : [ ]
  }
}

如有任何帮助，我们将不胜感激。 我是 Elasticsearch 的新手。

索引的映射：

{
    "_myIndex": {
        "mappings": {
            "_myType": {
                "properties": {
                    "eventID": {
                        "type": "string",
                        "index": "not_analyzed"
                    },
                    "eventName": {
                        "type": "string",
                        "index": "not_analyzed"
                    },
                    "message": {
                        "type": "string",
                        "index": "no"
                    },
                    "producerName": {
                        "type": "string",
                        "index": "not_analyzed"
                    },
                    "query": {
                        "properties": {
                            "bool": {
                                "properties": {
                                    "must": {
                                        "properties": {
                                            "range": {
                                                "properties": {
                                                    "timestamp": {
                                                        "properties": {
                                                            "gte": {
                                                                "type": "string"
                                                            },
                                                            "lt": {
                                                                "type": "string"
                                                            }
                                                        }
                                                    }
                                                }
                                            },
                                            "term": {
                                                "properties": {
                                                    "eventName": {
                                                        "properties": {
                                                            "value": {
                                                                "type": "string"
                                                            }
                                                        }
                                                    }
                                                }
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    },
                    "receivedTimestamp": {
                        "type": "long"
                    },
                    "size": {
                        "type": "long"
                    },
                    "timestamp": {
                        "type": "long"
                    }
                }
            }
        }
    }
}

Answer 1

问题在于您的 message 字段未编入索引 ("index": "no")，因此无法搜索。

您需要删除您的索引，然后将您的消息字段映射修改为下面的映射，然后重新索引您的数据即可。

                "message": {
                    "type": "string"
                },