不确定如何使用嵌套属性构造ElasticSearch Range查询

Question

我在ES中的对象如下所示：

{
  "_index": "myIndex",
  "_type": "myType",
  "_id": "75fd98d2-eca7-4a94-9dd8-1cc2c9b1fbbf",
  "_version": 2,
  "found": true,
  "_source": {
    "account_id": "100",
    "import_ids": [
      "4f4eef42-5493-464e-ac08-68a3a25a01fb"
    ],
    "accept": "html",
    "deleted_at": null,
    "signup_form_ids": [
      {
        "timestamp": "2015-11-23T20:08:11.604000",
        "signup_form_id": "1234"
      }
    ],
    "mailing_status": "active",
    "group_ids": [
      "0eddd2c0-ce70-4eb7-bcd8-9e41e41ac0b3"
    ],
    "confirmed_opt_in_at": null,
    "fields": [
      {
        "text_value": "My Company",
        "name": "company"
      },
      {
        "text_value": "Foo",
        "name": "first-name"
      },
      {
        "text_value": "Bar",
        "name": "last_name"
      },
      {
        "text_value": "555-555-5555",
        "name": "phone"
      }
    ],
    "created_at": "2015-11-23T19:20:15.889000",
    "last_modified_at": "2015-11-23T20:08:11.604000",
    "bounce_count": 0,
    "opted_out_at": null,
    "archived_at": null,
    "email": "example@example.com",
    "opt_out_mailing_id": "None"
  }
}

我试图运行编写一个查询，让我在那里的所有命中signup_form_ids.timestamp的lte now-7d/d。我正在查看https://www.elastic.co/guide/zh-CN/elasticsearch/reference/current/query-dsl-range-query.html#ranges-on-dates，但不确定如何构造查询

这是我到目前为止的内容：

{
    "query": {
        "nested": {
            "path": "signup_form_ids",
            "bool": {
                "must": [
                    {
                        "range": {
                            "timestamp" {
                                "lte": "now-7d/d"
                            }
                        }
                    }
                ]
            }
        },
        "bool": {
            "must": [
                {
                    "bool": {
                        "must": []
                    }
                },
                {
                    "match": {
                        "account_id": "100"
                    }
                },
                {
                    "filtered": {
                        "filter": {
                            "missing": {
                                "field": "deleted_at"
                            }
                        }
                    }
                }
            ]
        }
    },
    "size": 500,
    "from": 0
}

Answer 1

这里有几处错误，并且哪些是调整查询以发布到此处的工件，这并不完全清楚。

首先，"timestamp"查询后遗漏了一个冒号。另外，您的内部还有一个空的"bool"。而且您的"range"查询是不必要的"bool"。同样，您的"filtered"子句是多余的，您可以只"filter"在其中使用它。

但是主要的问题是：1）如果要应用所有条件，则"nested"查询必须在您的内部"bool"； 2）"nested" "range"过滤器需要指定到的完整路径"timestamp"； 3）子句的"bool"内部"nested"必须位于"filter"。

因此，为了使查询正常运行，进行了最小的调整，以下查询返回了您发布的文档（我将更改为"lte"，"gte"因此将返回您发布的文档，否则，它与查询不匹配）：

POST /test_index/_search
{
   "query": {
      "bool": {
         "must": [
            {
               "bool": {
                  "must": []
               }
            },
            {
               "match": {
                  "account_id": "100"
               }
            },
            {
               "filtered": {
                  "filter": {
                     "missing": {
                        "field": "deleted_at"
                     }
                  }
               }
            },
            {
               "nested": {
                  "path": "signup_form_ids",
                  "filter": {
                     "bool": {
                        "must": [
                           {
                              "range": {
                                 "signup_form_ids.timestamp": {
                                    "gte": "now-7d/d"
                                 }
                              }
                           }
                        ]
                     }
                  }
               }
            }
         ]
      }
   },
   "size": 500,
   "from": 0
}

如果我清理它以除去所有冗余，最终得到：

POST /test_index/_search
{
   "query": {
      "bool": {
         "must": [
            {
               "match": {
                  "account_id": "100"
               }
            },
            {
               "missing": {
                  "field": "deleted_at"
               }
            },
            {
               "nested": {
                  "path": "signup_form_ids",
                  "filter": {
                     "range": {
                        "signup_form_ids.timestamp": {
                           "gte": "now-7d/d"
                        }
                     }
                  }
               }
            }
         ]
      }
   },
   "size": 500,
   "from": 0
}

这是我以前玩过的一些代码：

http://sense.qbox.io/gist/ee96042c0505dfb07199b919d134b2a20c5a66fd