es 里的数据
{
"_index": "wap_2017-04-22",
"_type": "public.log",
"_id": "AVuWHBLUI5eim7",
"_score": null,
"_source": {
"logOffset": "22222222",
"message": "ws_addrrecommend|phone=111111111||json_str={\"errno\":0,\"errmsg\":\"\"}",
}
}
想以 message 里的 phone 为查询条件获取这条记录
使用
{
"query": {
"query_string": {
"default_field": "logOffset",
"query": "22222222"
}
}
}
能查到 es 里的数据
但是使用电话号码查询
{
"query": {
"query_string": {
"default_field": "message",
"query": "111111111"
}
}
}
返回 hits 为 0
请教如果想以 message 里某个字符串(比如phone),为查询条件,该怎么查?谢谢
1
Phant0m 2017-04-22 23:23:49 +08:00 via iPhone
通配符查询
|
2
wwwap OP @Phant0m
能详细说明一下吗? ``` { "query": { "wildcard" : { "message" : "*phone*" } } } ``` 试了几种类似这样的,都不行。麻烦指点一下,跪谢。 |
3
watzds 2017-04-23 01:10:44 +08:00 via Android
我只用过 term 过滤
|
4
SharkIng 2017-04-23 02:41:15 +08:00 via iPhone
查询只能通过 field 匹配吧
|
5
mazyi 2017-04-23 04:15:10 +08:00 via iPhone
message 这个 field 包含需要查询的电话号码字符串
phone 不是 field 所以不能直接匹配 |
6
polyomino 2017-04-23 05:43:08 +08:00 via Android
把映射信息输出来看看,默认情况下, message 字段的 type 是 string ,分析器好像会丢掉数字内容。而 logOffset 是 long 类型,不会被丢掉,所以能查到。
|
7
polyomino 2017-04-23 05:45:19 +08:00 via Android
用 GET wap_2017-04-22/_mapping 输出映射信息。
|
8
wwwap OP @polyomino
麻烦看一下,谢谢 "properties" : { "appName" : { "type" : "string", "index" : "not_analyzed" }, "args" : { "type" : "string", "index" : "no" }, "ariusTimestamp" : { "type" : "date", "format" : "YYYY-MM-dd HH:mm:ss || epoch_millis" }, "body" : { "type" : "string" }, "busiPayments" : { "type" : "string", "index" : "no" }, "cleanTime" : { "type" : "date", "fielddata" : { "loading" : "eager" }, "format" : "yyyy-MM-dd HH:mm:ss.SSS Z||yyyy-MM-dd HH:mm:ss.SSS||yyyy-MM-dd HH:mm:ss,SSS||yyyy/MM/dd HH:mm:ss||yyyy-MM-dd HH:mm:ss,SSS Z||yyyy/MM/dd HH:mm:ss,SSS Z||strict_date_optional_time||epoch_millis" }, "clientHost" : { "type" : "string", "index" : "not_analyzed" }, "collectTime" : { "type" : "date", "fielddata" : { "loading" : "eager" }, "format" : "yyyy-MM-dd HH:mm:ss.SSS Z||yyyy-MM-dd HH:mm:ss.SSS||yyyy-MM-dd HH:mm:ss,SSS||yyyy/MM/dd HH:mm:ss||yyyy-MM-dd HH:mm:ss,SSS Z||yyyy/MM/dd HH:mm:ss,SSS Z||strict_date_optional_time||epoch_millis" }, "errmsg" : { "type" : "string", "index" : "no" }, "httpRpcCount" : { "type" : "integer" }, "in" : { "type" : "string", "index" : "no" }, "jsonMsg" : { "type" : "object" }, "json_annotations" : { "type" : "nested" }, "logID" : { "type" : "string", "index" : "no" }, "logName" : { "type" : "string", "index" : "not_analyzed" }, "logOffset" : { "type" : "string", "index" : "not_analyzed" }, "logTime" : { "type" : "date", "fielddata" : { "loading" : "eager" }, "format" : "yyyy-MM-dd HH:mm:ss.SSS Z||yyyy-MM-dd HH:mm:ss.SSS||yyyy-MM-dd HH:mm:ss,SSS||yyyy/MM/dd HH:mm:ss||yyyy-MM-dd HH:mm:ss,SSS Z||yyyy/MM/dd HH:mm:ss,SSS Z||strict_date_optional_time||epoch_millis" }, "message" : { "type" : "string", "index" : "no" }, "orderId" : { "type" : "string", "index" : "not_analyzed" }, "order_id" : { "type" : "string", "index" : "not_analyzed" }, "out" : { "type" : "string", "index" : "no" }, "passengerid" : { "type" : "string", "index" : "not_analyzed" }, "proc_time" : { "type" : "double" }, "projectName" : { "type" : "string", "index" : "no" }, "request" : { "type" : "string", "index" : "no" }, "response" : { "type" : "string", "index" : "no" }, "rpcTotal" : { "type" : "integer" }, "sinkTime" : { "type" : "date", "fielddata" : { "loading" : "eager" }, "format" : "yyyy-MM-dd HH:mm:ss.SSS Z||yyyy-MM-dd HH:mm:ss.SSS||yyyy-MM-dd HH:mm:ss,SSS||yyyy/MM/dd HH:mm:ss||yyyy-MM-dd HH:mm:ss,SSS Z||yyyy/MM/dd HH:mm:ss,SSS Z||strict_date_optional_time||epoch_millis" }, "sink_flag" : { "type" : "string", "index" : "no" }, "thriftRpcCount" : { "type" : "integer" }, "timestamp" : { "type" : "date", "format" : "yyyy-MM-dd HH:mm:ss Z||yyyy-MM-dd HH:mm:ss||yyyy-MM-dd HH:mm:ss.SSS Z||yyyy-MM-dd HH:mm:ss.SSS||yyyy-MM-dd HH:mm:ss,SSS||yyyy/MM/dd HH:mm:ss||yyyy-MM-dd HH:mm:ss,SSS Z||yyyy/MM/dd HH:mm:ss,SSS Z||epoch_millis" }, "traceid" : { "type" : "string", "index" : "not_analyzed" } } |
9
polyomino 2017-04-23 19:25:57 +08:00 via Android
@wwwap 看 message 那部分, index:no ,说明没有被索引,这个字段的内容是不能被搜索的。只能重新设置 mapping ,然后再索引数据。把它设置成 not_analyzed 就可以。
|
11
vus520 2017-04-23 23:56:03 +08:00
|