为什么 Elasticsearch/Opensearch 查询返回所有内容？

Question

我正在使用 AWS 的 OpenSearch，但我无法将任何查询或过滤器仅 return 匹配结果。

为了测试，我正在使用包含字段“customer_gender”的示例电子商务数据，该字段是“MALE”或 FEMALE 之一。我正在尝试使用以下查询：

GET /kibana_sample_data_ecommerce/_search

{
  "query": {
    "multi_match": {
      "query" : "FEMALE"
      "fields": ["customer_gender"]
    }
  }
}

但是所有带有“MALE”的结果仍然显示。我尝试将此作为 POST 请求而不是 GET 请求，我尝试过小写，我尝试过使用术语查询和全文查询（如 match），我每次都得到相同的结果。有什么方法可以让我错误地格式化这些查询吗？我搜索了文档，但没能找到任何不同的线索。

以下是我尝试过的其他类型查询的一些 JSON 示例：

{
  "query": {
    "match": {
      "customer_gender": "FEMALE"
    }
  }
}

{
  "query": {
    "match": {
      "customer_gender": {
        "value": "FEMALE"
      }
    }
  }
}

{
  "query": {
    "constant_score": {
      "filter": {
        "term": {
          "customer_gender": "FEMALE"
        }
      }
    }
  }
}

下面是查询对象的 _source 示例：

        {
          "category" : [
            "Men's Clothing"
          ],
          "currency" : "EUR",
          "customer_first_name" : "Eddie",
          "customer_full_name" : "Eddie Underwood",
          "customer_gender" : "MALE",
          "customer_id" : 38,
          "customer_last_name" : "Underwood",
          "customer_phone" : "",
          "day_of_week" : "Monday",
          "day_of_week_i" : 0,
          "email" : "eddie@underwood-family.zzz",
          "manufacturer" : [
            "Elitelligence",
            "Oceanavigations"
          ],
          "order_date" : "2021-11-29T09:28:48+00:00",
          "order_id" : 584677,
          "products" : [
            {
              "base_price" : 11.99,
              "discount_percentage" : 0,
              "quantity" : 1,
              "manufacturer" : "Elitelligence",
              "tax_amount" : 0,
              "product_id" : 6283,
              "category" : "Men's Clothing",
              "sku" : "ZO0549605496",
              "taxless_price" : 11.99,
              "unit_discount_amount" : 0,
              "min_price" : 6.35,
              "_id" : "sold_product_584677_6283",
              "discount_amount" : 0,
              "created_on" : "2016-12-26T09:28:48+00:00",
              "product_name" : "Basic T-shirt - dark blue/white",
              "price" : 11.99,
              "taxful_price" : 11.99,
              "base_unit_price" : 11.99
            },
            {
              "base_price" : 24.99,
              "discount_percentage" : 0,
              "quantity" : 1,
              "manufacturer" : "Oceanavigations",
              "tax_amount" : 0,
              "product_id" : 19400,
              "category" : "Men's Clothing",
              "sku" : "ZO0299602996",
              "taxless_price" : 24.99,
              "unit_discount_amount" : 0,
              "min_price" : 11.75,
              "_id" : "sold_product_584677_19400",
              "discount_amount" : 0,
              "created_on" : "2016-12-26T09:28:48+00:00",
              "product_name" : "Sweatshirt - grey multicolor",
              "price" : 24.99,
              "taxful_price" : 24.99,
              "base_unit_price" : 24.99
            }
          ],
          "sku" : [
            "ZO0549605496",
            "ZO0299602996"
          ],
          "taxful_total_price" : 36.98,
          "taxless_total_price" : 36.98,
          "total_quantity" : 2,
          "total_unique_products" : 2,
          "type" : "order",
          "user" : "eddie",
          "geoip" : {
            "country_iso_code" : "EG",
            "location" : {
              "lon" : 31.3,
              "lat" : 30.1
            },
            "region_name" : "Cairo Governorate",
            "continent_name" : "Africa",
            "city_name" : "Cairo"
          },
          "event" : {
            "dataset" : "sample_ecommerce"
          }
        }

编辑：Kibana dashboards/explore 页面的查询都很好，请注意，但是当我将相同的查询复制粘贴到控制台时，它仍然无法正常工作

Answer 1

问题是 GET 和查询之间有一个空行，所以没有发送任何查询，因此它等同于 match_all 查询：

GET /kibana_sample_data_ecommerce/_search
                         <--- remove this empty line
{
  "query": {
    "multi_match": {
      "query" : "FEMALE"
      "fields": ["customer_gender"]
    }
  }
}

为什么 Elasticsearch/Opensearch 查询返回所有内容？

Why is Elasticsearch/Opensearch query returning everything?

amazon-web-services

opensearch

elasticsearch

kibana

aws-elasticsearch