must_not 子句在弹性中不起作用

Question

我有以下格式的弹性文档，其中主干值可以是 [1PCX05, 2PCX05, 3PCX05 6PCX05]

之一

 "doc": {
      "keys": {
        "trunk": "6PCX05",
        "direction": "incoming",
        "country": "CHN",
        "service": "ENTVTS",
        "company": "XYZ"
      }
}

但是当我运行按照查询过滤文档时公司字段和must_not->具有特定中继的条款 但 must_not 条款没有得到应用，我得到了公司名称为“XYZ”的所有文件

POST /my_index-*/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "match": {
            "doc.keys.company": {
              "query": "XYZ",
              "operator": "OR",
              "prefix_length": 0,
              "max_expansions": 50,
              "fuzzy_transpositions": true,
              "lenient": false,
              "zero_terms_query": "NONE",
              "auto_generate_synonyms_phrase_query": true,
              "boost": 1
            }
          }
        }
      ],
      "must_not": [
        {
          "terms": {
            "doc.keys.trunk": [
              "3PCX05,2PCX05,1PCX05"
            ],
            "boost": 1
          }
        }
      ],
      "adjust_pure_negative": true,
      "boost": 1
    }
  }
}

我也尝试在 doc.keys.trunk.keyword 中使用关键字，但仍然无效

Answer 1

TLDR;

您确定 .keyword 不起作用吗？对我来说，很明显这是解决问题的方法。

复制

我创建了一个玩具项目来尝试模拟您的情况。


# Truck 1
POST /71188384/_doc
{
  "doc": {
    "keys": {
      "trunk": "6PCX05",
      "direction": "incoming",
      "country": "CHN",
      "service": "ENTVTS",
      "company": "XYZ"
    }
  }
}

# Truck 2
POST /71188384/_doc
{
  "doc": {
    "keys": {
      "trunk": "6PCX06",
      "direction": "incoming",
      "country": "CHN",
      "service": "ENTVTS",
      "company": "XYZ"
    }
  }
}


GET /71188384/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "match": {
            "doc.keys.company": {
              "query": "XYZ",
              "operator": "OR",
              "prefix_length": 0,
              "max_expansions": 50,
              "fuzzy_transpositions": true,
              "lenient": false,
              "zero_terms_query": "NONE",
              "auto_generate_synonyms_phrase_query": true,
              "boost": 1
            }
          }
        }
      ],
      "must_not": [
        {
          "terms": {
            "doc.keys.trunk.keyword": ["6PCX05"],
            "boost": 1
          }
        }
      ],
      "adjust_pure_negative": true,
      "boost": 1
    }
  }
}

我确实成功了Truck 2

{
  ...
        "_source" : {
          "doc" : {
            "keys" : {
              "trunk" : "6PCX06",
              "direction" : "incoming",
              "country" : "CHN",
              "service" : "ENTVTS",
              "company" : "XYZ"
            }
          }
        }
     ...
}

这是我的映射：

{
  "71188384" : {
    "aliases" : { },
    "mappings" : {
      "properties" : {
        "doc" : {
          "properties" : {
            "keys" : {
              "properties" : {
                "company" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "country" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "direction" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "service" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "trunk" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "settings" : {
      "index" : {
        "routing" : {
          "allocation" : {
            "include" : {
              "_tier_preference" : "data_content"
            }
          }
        },
        "number_of_shards" : "1",
        "provided_name" : "71188384",
        "creation_date" : "1645309336806",
        "number_of_replicas" : "1",
        "uuid" : "5vw9ZKmYQ1aWh_Rs0ajckg",
        "version" : {
          "created" : "7160399"
        }
      }
    }
  }
}

must_not 子句在弹性中不起作用

must_not cluase is not working in elastic

elasticsearch

elastic-stack

elk

TLDR;

复制