命名查詢Elasticsearch在should陣列中不起作用

我試圖使用命名查詢來查看滿足哪個條件，無論是標簽一還是標簽二，但它不起作用，實作這一目標的正確方法是什么？該示例指出“_name”標簽應該在一個布林值中使用，所以我不確定問題可能是什么。

GET /myindex/_search
{
  "_source": ["ids"],
    "query": {
        "bool": {
            "must": [
              {
                    "range": {
                        "timestamp": {
                          "format": "strict_date_optional_time",
                          "gte": "2022-02-21T20:44:07.099Z",
                          "lte": "2022-03-23T20:44:07.099Z"
                        }
                    }
                },
                {
                    "bool": {
                        "should": [
                          {
                          "_name": "tag-one",
                            "query_string": {
                              "query":"*hello*",
                                "fields":["field1","field2","field3"]
                            }
                        },
                        {
                            "query_string": {
                                "query":"*world*",
                                "fields":["field1","field2","field3"]
                            },
                             "_name": "tag-two"
                        }
                        ]
                    }
                }
            ]
        }
    },
    "size": 10000
}

我得到的錯誤：

{
  "error" : {
    "root_cause" : [
      {
        "type" : "parsing_exception",
        "reason" : "[_name] query malformed, no start_object after query name",
        "line" : 19,
        "col" : 18
      }
    ],
    "type" : "x_content_parse_exception",
    "reason" : "[19:18] [bool] failed to parse field [must]",
    "caused_by" : {
      "type" : "x_content_parse_exception",
      "reason" : "[19:18] [bool] failed to parse field [should]",
      "caused_by" : {
        "type" : "parsing_exception",
        "reason" : "[_name] query malformed, no start_object after query name",
        "line" : 19,
        "col" : 18
      }
    }
  },
  "status" : 400
}

uj5u.com熱心網友回復：

來自Elasticsearch 檔案

每個查詢在其頂級定義中接受一個 _name。您可以使用命名查詢來跟蹤哪些查詢與回傳的檔案匹配。

您需要將_named查詢包含在query_string. 將您的搜索查詢修改為

{
    "_source": [
        "ids"
    ],
    "query": {
        "bool": {
            "must": [
                {
                    "range": {
                        "timestamp": {
                            "format": "strict_date_optional_time",
                            "gte": "2022-02-21T20:44:07.099Z",
                            "lte": "2022-03-23T20:44:07.099Z"
                        }
                    }
                },
                {
                    "bool": {
                        "should": [
                            {
                                "query_string": {
                                    "query": "*hello*",
                                    "fields": [
                                        "field1",
                                        "field2",
                                        "field3"
                                    ],
                                    "_name": "tag-one"           //note this
                                }
                            },
                            {
                                "query_string": {
                                    "query": "*world*",
                                    "fields": [
                                        "field1",
                                        "field2",
                                        "field3"
                                    ],
                                    "_name": "tag-two"
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "size": 10000
}

標籤：弹性搜索 日志存储 木花 弹性堆栈

上一篇：如何在彈性搜索中搜索一系列術語？

下一篇：在MacBookPro上更改asdf安裝的elasticsearch設定