elasticsearch嵌套查询仅返回最后3个结果

Question

我们有以下elasticsearch映射

{
    index: 'data',
    body: {
        settings: {
            analysis: {
                analyzer: {
                    lowerCase: {
                        tokenizer: 'whitespace',
                        filter: ['lowercase']
                    }
                }
            }
        },
        mappings: {
            // used for _all field
            _default_: {
                index_analyzer: 'lowerCase'
            },
            entry: {
                properties: {
                    id: { type: 'string', analyzer: 'lowerCase' },
                    type: { type: 'string', analyzer: 'lowerCase' },
                    name: { type: 'string', analyzer: 'lowerCase' },
                    blobIds: {
                        type: 'nested',
                        properties: {
                            id: { type: 'string' },
                            filename: { type: 'string', analyzer: 'lowerCase' }
                        }
                    }
                }
            }
        }
    }
}

和如下所示的示例文档：

{
    "id":"5f02e9dae252732912749e13",
    "type":"test_type",
    "name":"test_name",
    "creationTimestamp":"2020-07-06T09:07:38.775Z",
    "blobIds":[
        {
            "id":"5f02e9dbe252732912749e18",
            "filename":"test1.csv"
        },
        {
            "id":"5f02e9dbe252732912749e1c",
            "filename":"test2.txt"
        },
        // removed in-between elements for simplicity
        {
            "id":"5f02e9dbe252732912749e1e",
            "filename":"test3.csv"
        },
        {
            "id":"5f02e9dbe252732912749e58",
            "filename":"test4.txt"
        },
        {
            "id":"5f02e9dbe252732912749e5a",
            "filename":"test5.csv"
        },
        {
            "id":"5f02e9dbe252732912749e5d",
            "filename":"test6.txt"
        }
    ]
}

我有以下ES查询，该查询基于creationTimestamp字段查询特定时间范围的文档，然后根据用户查询过滤嵌套字段blobIds，该查询应与{{1 }}字段。

blobIds.filename

上面的条目显然与查询匹配。但是，返回的inner_hits似乎有问题，因为我总是只获取最后3个{ "query": { "filtered": { "filter": { "bool": { "must": [ { "range": { "creationTimestamp": { "gte": "2020-07-01T09:07:38.775Z", "lte": "2020-07-07T09:07:40.147Z" } } }, { "nested": { "path": [ "blobIds" ], "query": { "query_string": { "fields": [ "blobIds.filename" ], "query": "*" } }, // returns the actual blobId hit // and not the whole array "inner_hits": {} } }, { "query": { "query_string": { "query": "+type:*test_type* +name:*test_name*" } } } ] } } } }, "sort": [ { "creationTimestamp": { "order": "asc" }, "id": { "order": "asc" } } ] } 元素，而不是包含24个元素的整个数组，如下所示。

blobIds

我发现它很奇怪，因为我只在做一个简单的{ "name": "test_name", "creationTimestamp": "2020-07-06T09:07:38.775Z", "id": "5f02e9dae252732912749e13", "type": "test_type", "blobIds": [ { "id": "5f02e9dbe252732912749e5d", "filename": "test4.txt" }, { "id": "5f02e9dbe252732912749e5a", "filename": "test5.csv" }, { "id": "5f02e9dbe252732912749e58", "filename": "test6.txt" } ] } 查询。

正在使用* v1.7，目前无法更新