Elasticsearch 查询 DSL:字段长度(如果字段存在)

问题描述 投票:0回答:2

说我有一个领域,

data.url
。我们的有些日志包含此字段,有些则不包含。我只想返回
data.url
长度超过 50 个字符的结果。实际上我只需要一个 URL 列表。

我正在努力:

GET _search
{
  "query": {
    "bool": {
      "filter": {
        "script": {
          "script": {
            "source": "doc['data.url'].value.length() > 50",
            "lang": "painless"
          }
        }
      }
    }
  }
}

但是会出现混合错误:

{
  "error" : {
    "root_cause" : [
      {
        "type" : "script_exception",
        "reason" : "runtime error",
        "script_stack" : [
          "org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:90)",
          "org.elasticsearch.search.lookup.LeafDocLookup.get(LeafDocLookup.java:41)",
          "doc['data.url'].value.length() > 50",
          "    ^---- HERE"
        ],
        "script" : "doc['data.url'].value.length() > 50",
        "lang" : "painless",
        "position" : {
          "offset" : 4,
          "start" : 0,
          "end" : 35
        }
      },

        "type" : "script_exception",
        "reason" : "runtime error",
        "script_stack" : [
          "org.elasticsearch.index.fielddata.ScriptDocValues$Strings.get(ScriptDocValues.java:496)",
          "org.elasticsearch.index.fielddata.ScriptDocValues$Strings.getValue(ScriptDocValues.java:503)",
          "doc['data.url'].value.length() > 50",
          "               ^---- HERE"
        ],
        "script" : "doc['data.url'].value.length() > 50",
        "lang" : "painless",
        "position" : {
          "offset" : 15,
          "start" : 0,
          "end" : 35
        }

          "caused_by" : {
            "type" : "illegal_argument_exception",
            "reason" : "No field found for [data.url] in mapping with types []"
          }

有时

          "caused_by" : {
            "type" : "illegal_state_exception",
            "reason" : "A document doesn't have a value for a field! Use doc[<field>].size()==0 to check if a document is missing a field!"
          }

这个字段肯定存在;我可以在日志中看到它,在搜索字段中搜索,并使用术语作品:

GET _search
{
  "query": {
    "bool": {
      "filter": {
        "term": {
          "data.url": "www.google.com"
        }
      }
    }
  }
}

我错过了什么?

我正在使用 Elasticsearch 7.8。

elasticsearch kibana querydsl
2个回答
0
投票

由于您使用的是版本7.*,因此您需要使用下面的脚本查询

{
  "query": {
    "bool": {
      "filter": {
        "script": {
          "script": {
            "source": "doc['data.url.keyword'].length > 50",
            "lang": "painless"
          }
        }
      }
    }
  }
}

如果

data.url
字段是
keyword
类型,则忽略字段末尾的
".keyword"


0
投票

没有 meu caso,解决以下问题:

{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "field1": 8854
          }
        }
      ],
      "must_not": [
        {
          "regexp": {
            "field2": {
              "value": ".{0,10}"
            }
          }
        }
      ]
    }
  }
}
© www.soinside.com 2019 - 2024. All rights reserved.