我有这些文件：
{
"took": 1,
"timed_out": false,
"_shards": {...},
"hits": {
"total": 20584,
"max_score": 8.143582,
"hits": [
{
"_index": "nyc_visionzero",
"_type": "logs",
"_id": "AVwMozs3iTTcr81oIxfl",
"_score": 8.143582,
"_source": {
"date": "02/12/2017",
"number_of_motorist_injured": 2,
"contributing_factor_vehicle": "Unsafe Speed",
}
...
如果我执行此查询，我想获取所有字段contributing_factor_vehicle包含文本unsafe的内容：
{
"query":{
"query_string": {
"query": "unsafe"
}
}
}
它会返回包含不安全的所有结果，但我想将其限制为字段contributing_factor_vehicle 。
{
"nyc_visionzero": {
"mappings": {
"logs": {
"_all": {
"enabled": true
},
"dynamic_templates": [
{
"string_fields": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"fields": {
"raw": {
"ignore_above": 256,
"type": "keyword"
}
},
"omit_norms": true,
"type": "text"
}
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "keyword"
},
"borough": {
"type": "keyword"
},
"contributing_factor_vehicle": {
"type": "keyword"
},
"coords": {
"type": "geo_point"
},
"cross_street_name": {
"type": "keyword"
},
"date": {
"type": "text",
"norms": false,
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
},
"host": {
"type": "text",
"norms": false,
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
},
"hour_of_day": {
"type": "integer"
},
"intersection": {
"type": "keyword"
},
"latitude": {
"type": "text",
"norms": false,
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
},
"location": {
"type": "text",
"norms": false,
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
},
"longitude": {
"type": "text",
"norms": false,
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
},
"message": {
"type": "text",
"norms": false,
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
},
"number_of_cyclist_injured": {
"type": "long"
},
"number_of_cyclist_killed": {
"type": "long"
},
"number_of_motorist_injured": {
"type": "long"
},
"number_of_motorist_killed": {
"type": "long"
},
"number_of_pedestrians_injured": {
"type": "long"
},
"number_of_pedestrians_killed": {
"type": "long"
},
"number_of_persons_injured": {
"type": "long"
},
"number_of_persons_killed": {
"type": "long"
},
"number_persons_impacted": {
"type": "long"
},
"off_street_name": {
"type": "keyword"
},
"on_street_name": {
"type": "keyword"
},
"query": {
"properties": {
"match_all": {
"type": "object"
}
}
},
"tags": {
"type": "text",
"norms": false,
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
},
"time": {
"type": "text",
"norms": false,
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
},
"unique_key": {
"type": "text",
"norms": false,
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
},
"vehicle_type": {
"type": "text",
"norms": false,
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
},
"zip_code": {
"type": "text",
"norms": false,
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
}
}
答案 0 :(得分：0)
由于contributing_factor_vehicle字段属于keyword类型，这意味着值不会获得analyzed并将按原样存储。
有两种方法可以解决这个问题。使用以下查询搜索完全匹配：
"query": {
"term": {
"contributing_factor_vehicle": {
"value": "Unsafe Speed" <--- Exact Term (check case)
}
}
}
或者如果您不希望不区分大小写搜索，请将contributing_factor_vehicle创建为多字段，默认情况下为ES 5，或者如果您的版本为＆lt; 5.x
POST index
{
"mappings": {
"type": {
"properties": {
"contributing_factor_vehicle": {
"type": "string",
"fields": {
"raw": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}
}}
然后你可以像这样查询。 ：
{
"query":{
"query_string": {
"query": "unsafe",
"default_field" : "contributing_factor_vehicle"
}
}
}