我是Elastic Search的新手，在实现某些查询时遇到一些问题。以下是我的索引结构
{
"cl_1" : {
"aliases" : { },
"mappings" : {
"properties" : {
"@timestamp" : {
"type" : "date"
},
"@version" : {
"type" : "long"
},
"class" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"file" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"level" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"line_number" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"logger_name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"mdc" : {
"type" : "object"
},
"message" : {
"properties" : {
"connectionStats" : {
"properties" : {
"activeConnections" : {
"type" : "long"
},
"idleConnections" : {
"type" : "long"
},
"maxConnections" : {
"type" : "long"
},
"minConnections" : {
"type" : "long"
},
"pendingConnections" : {
"type" : "long"
},
"totalConnections" : {
"type" : "long"
}
}
},
"dbhistogram" : {
"type" : "nested",
"properties" : {
"histogramName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"snapshot" : {
"properties" : {
"max" : {
"type" : "float"
},
"mean" : {
"type" : "float"
},
"median" : {
"type" : "float"
},
"min" : {
"type" : "float"
},
"percentile75" : {
"type" : "float"
},
"percentile95" : {
"type" : "float"
},
"percentile98" : {
"type" : "float"
},
"percentile99" : {
"type" : "float"
},
"percentile99_9" : {
"type" : "float"
},
"sd" : {
"type" : "float"
}
}
},
"totalCount" : {
"type" : "long"
}
}
},
"healthy" : {
"type" : "boolean"
},
"meters" : {
"properties" : {
"meterName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"meterRate" : {
"properties" : {
"fifteenMinRate" : {
"type" : "float"
},
"fiveMinRate" : {
"type" : "float"
},
"meanRate" : {
"type" : "float"
},
"oneMinRate" : {
"type" : "float"
}
}
},
"totalCount" : {
"type" : "long"
}
}
},
"timers" : {
"properties" : {
"meterRate" : {
"properties" : {
"fifteenMinRate" : {
"type" : "float"
},
"fiveMinRate" : {
"type" : "float"
},
"meanRate" : {
"type" : "float"
},
"oneMinRate" : {
"type" : "float"
}
}
},
"snapshot" : {
"properties" : {
"max" : {
"type" : "float"
},
"mean" : {
"type" : "float"
},
"median" : {
"type" : "float"
},
"min" : {
"type" : "float"
},
"percentile75" : {
"type" : "float"
},
"percentile95" : {
"type" : "float"
},
"percentile98" : {
"type" : "float"
},
"percentile99" : {
"type" : "float"
},
"percentile99_9" : {
"type" : "float"
},
"sd" : {
"type" : "float"
}
}
},
"timerName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"totalCount" : {
"type" : "long"
}
}
}
}
},
"method" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"source_host" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"thread_name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"settings" : {
"index" : {
"creation_date" : "1590152167021",
"number_of_shards" : "1",
"number_of_replicas" : "1",
"uuid" : "Aa-KrQinQyiY_racF-Kuxg",
"version" : {
"created" : "7070099"
},
"provided_name" : "cl_1"
}
}
}
}
以下是示例数据
{
"_index" : "cl_1",
"_type" : "_doc",
"_id" : "1545",
"_version" : 1,
"_seq_no" : 1544,
"_primary_term" : 1,
"found" : true,
"_source" : {
"@timestamp" : "2020-05-19T05:18:53.318Z",
"source_host" : "127.0.0.1",
"file" : "DBConnectionMetricsTask.java",
"method" : "run",
"level" : "INFO",
"line_number" : "135",
"thread_name" : "Timer-1",
"@version" : 1,
"logger_name" : "DBConnectionMetricsTask",
"message" : {
"counters" : [ ],
"connectionStats" : [
{
"pendingConnections" : 0,
"activeConnections" : 0,
"idleConnections" : 3,
"maxConnections" : 1000,
"minConnections" : 2,
"totalConnections" : 3
}
],
"timers" : [
{
"timerName" : "controller.pool.Wait",
"totalCount" : 254246,
"meterRate" : {
"fiveMinRate" : 2.475461869555687,
"fifteenMinRate" : 2.3810523391920393,
"oneMinRate" : 2.472677418621866,
"meanRate" : 5.486619709297191
},
"snapshot" : {
"percentile75" : 2344164.0,
"percentile95" : 3486516.0,
"percentile98" : 7008980.0,
"percentile99" : 1.0038282E7,
"percentile99_9" : 4.8125997E7,
"min" : 538.0,
"max" : 4.8125997E7,
"mean" : 2156193.438475141,
"median" : 2023267.0,
"sd" : 3169808.0894894
}
}
],
"meters" : [
{
"totalCount" : 0,
"meterName" : "controller.pool.ConnectionTimeoutRate",
"meterRate" : {
"fiveMinRate" : 0.0,
"fifteenMinRate" : 0.0,
"oneMinRate" : 0.0,
"meanRate" : 0.0
}
}
],
"dbhistogram" : [
{
"histogramName" : "controller.pool.ConnectionCreation",
"totalCount" : 167,
"snapshot" : {
"percentile75" : 102.0,
"percentile95" : 102.0,
"percentile98" : 102.0,
"percentile99" : 102.0,
"percentile99_9" : 131.0,
"min" : 62.0,
"max" : 1234.0,
"mean" : 100.04099508328834,
"median" : 98.0,
"sd" : 2.633890647922372
}
},
{
"histogramName" : "controller.pool.Usage",
"totalCount" : 254246,
"snapshot" : {
"percentile75" : 1.0,
"percentile95" : 9.0,
"percentile98" : 36.0,
"percentile99" : 89.0,
"percentile99_9" : 178.0,
"min" : 0.0,
"max" : 772.0,
"mean" : 3.5603336398866645,
"median" : 1.0,
"sd" : 15.699410900677693
}
}
],
"healthy" : true
},
"class" : "DBConnectionMetricsTask",
"mdc" : { }
}
}
我想在message.dbhistogram的{{1}}中查询数据。由于histogramName : controller.pool.ConnectionCreation是Json对象的数组，所以我的目的是仅从通过过滤器上方的数组中检索该对象。
我尝试了以下两个查询：
查询1
dbhistogram查询2
GET cl_1/_search
{
"_source": "message.dbhistogram.*",
"query": {
"nested": {
"path": "message.dbhistogram",
"query": {
"bool": {
"must": [
{
"term": {
"message.dbhistogram.histogramName.keyword": {
"value": "controller.pool.ConnectionCreation"
}
}
}
]
, "must_not": [
{
"term": {
"message.dbhistogram.histogramName.keyword": {
"value": "controller.pool.Usage"
}
}
}
]
}
}
}
}
}
我的期望
GET cl_1/_search
{
"_source": "message.dbhistogram.*",
"query": {
"nested": {
"path": "message.dbhistogram",
"query": {
"bool": {
"must": [
{
"match": {
"message.dbhistogram.histogramName": "controller.pool.ConnectionCreation"
}
}
]
,
"must_not": [
{
"match": {
"message.dbhistogram.histogramName.keyword": "controller.pool.Usage"
}
}
]
}
}
}
}
}
现实
{
"took": 3,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": {
"value": 1545,
"relation": "eq"
},
"max_score": 0.6931471,
"hits": [
{
"_index": "cl_1",
"_type": "_doc",
"_id": "57",
"_score": 0.6931471,
"_source": {
"message": {
"dbhistogram": [
{
"totalCount": 10,
"histogramName": "controller.pool.ConnectionCreation",
"snapshot": {
"sd": 35.86065,
"percentile98": 270,
"percentile99": 270,
"min": 139,
"percentile99_9": 270,
"median": 270,
"percentile75": 270,
"max": 597,
"mean": 258.89444,
"percentile95": 270
}
}
]
}
}
}
]
}
}
请提出建议，我在做什么错了？
答案 0 :(得分：1)
@jaspreet是正确的-尽管nested子文档被视为单独的文档，但是_source仍将检索给定路径下的所有内容。
因此，请使用inner_hits，并注意我们也在_source中提及了它们：
GET cl_1/_search
{
"_source": "inner_hits.message.dbhistogram.*",
"query": {
"nested": {
"inner_hits": {},
"path": "message.dbhistogram",
"query": {
"bool": {
"must": [
{
"match": {
"message.dbhistogram.histogramName": "controller.pool.ConnectionCreation"
}
}
],
"must_not": [
{
"match": {
"message.dbhistogram.histogramName.keyword": "controller.pool.Usage"
}
}
]
}
}
}
}
}
或使用所谓的named inner_hits，以防您在不同的位置多次使用inner_hits：
GET cl_1/_search
{
"_source": "inner_hits__message_dbhistogram.message.dbhistogram.*",
"query": {
"nested": {
"inner_hits": {
"name": "inner_hits__message_dbhistogram"
},
"path": "message.dbhistogram",
"query": {
"bool": {
"must": [
{
"match": {
"message.dbhistogram.histogramName": "controller.pool.ConnectionCreation"
}
}
],
"must_not": [
{
"match": {
"message.dbhistogram.histogramName.keyword": "controller.pool.Usage"
}
}
]
}
}
}
}
}