在包含路径值的字段上使用通配符过滤器进行弹性搜索查询答案

【问题标题】：Elastic search query with wildcard filter on field containing path values在包含路径值的字段上使用通配符过滤器进行弹性搜索查询
【发布时间】：2021-11-28 02:25:45
【问题描述】：

我正在尝试编写一个弹性搜索查询，它可以让我在包含路径值的字段上基于通配符搜索多条记录。我的数据如下所示：

[{
    "_index": "my-data",
    "_type": "_doc",
    "_id": "fil.33dc27bd183c4b92a18d08d9525398d2",
    "_score": 0.0018758172,
    "_source": {
        "sizeInBytes": 1,
        "parentFolderId": "fol.844354089a8b4151577708d95305cbca",
        "type": "text/plain",
        "timeModified": "2021-07-30T04:50:37.687Z",
        "path": "/folder2/testfile.10.207",
        "storageTier": "Standard",
        "volumeId": "vol.fe502fc3c23246b51d1708d936facf5f",
        "timeCreated": "2021-07-30T04:50:37.687Z",
        "isUploaded": true,
        "eTag": "5058f1af8388633f609cadb75a75dc9d",
        "id": "fil.33dc27bd183c4b92a18d08d9525398d2",
        "dataType": "File",
        "volumeName": "kctest2",
        "name": "testfile.10.207",
        "archiveStatus": "None",
        "status": "Available"
    }
}, {
    "_index": "my-data",
    "_type": "_doc",
    "_id": "fil.20935f2a158248c4582d08d95305cbca",
    "_score": 0.0018758172,
    "_source": {
        "sizeInBytes": 1,
        "parentFolderId": "fol.844354089a8b4151577708d95305cbca",
        "type": "text/plain",
        "timeModified": "2021-07-30T04:50:39.035Z",
        "path": "/folder2/testfile.10.70",
        "storageTier": "Standard",
        "volumeId": "vol.fe502fc3c23246b51d1708d936facf5f",
        "timeCreated": "2021-07-30T04:50:39.035Z",
        "isUploaded": true,
        "eTag": "5058f1af8388633f609cadb75a75dc9d",
        "id": "fil.20935f2a158248c4582d08d95305cbca",
        "dataType": "File",
        "volumeName": "kctest2",
        "name": "testfile.10.70",
        "status": "Available"
    }
}, {
    "_index": "my-data",
    "_type": "_doc",
    "_id": "fil.a4912bfbbad84952a19108d9525398d2",
    "_score": 0.0018758172,
    "_source": {
        "sizeInBytes": 1,
        "parentFolderId": "fol.65037e6e669b49b356b408d95305cbca",
        "type": "text/plain",
        "timeModified": "2021-07-30T04:50:38.101Z",
        "path": "/folder1/testfile.101.195",
        "volumeId": "vol.fe502fc3c23246b51d1708d936facf5f",
        "timeCreated": "2021-07-30T04:50:38.101Z",
        "isUploaded": true,
        "eTag": "5058f1af8388633f609cadb75a75dc9d",
        "id": "fil.a4912bfbbad84952a19108d9525398d2"
        "dataType": "File",
        "volumeName": "kctest2",
        "name": "testfile.101.195",
        "archiveStatus": "None",
        "status": "Available"
    }
}]

我正在尝试创建这样的查询：

https://mycompanyelasticsearch.com/my-data/_search?q=volumeId:vol.fe502fc3c23246b51d1708d936facf5f AND dataType:"File" AND path:"/folder2/*"

打算查找所有记录：

与volumeId关联：vol.fe502fc3c23246b51d1708d936facf5f
属于数据类型：文件
还有存储在路径值 /folder2/* 的所有文件

所以我没有指定绝对路径值，而是尝试在末尾使用通配符 *，这样我就可以搜索 /folder2/ 路径下的所有文件。

但它没有返回预期的结果，实际上没有返回任何数据。

此查询适用于绝对路径值：

https://mycompanyelasticsearch.com/my-data/_count?q=volumeId:vol.fe502fc3c23246b51d1708d936facf5f AND dataType:File AND path:"/folder2/testfile.10.70"

但使用通配符则不会。

如果这里相关的是关于路径字段映射的信息：

{
    "my-data": {
        "mappings": {
            "path": {
                "full_name": "path",
                "mapping": {
                    "path": {
                        "type": "text",
                        "fields": {
                            "raw": {
                                "type": "keyword"
                            },
                            "rawlower": {
                                "type": "keyword",
                                "normalizer": "lowercase"
                            },
                            "tree": {
                                "type": "text",
                                "analyzer": "path_analyzer"
                            },
                            "tree_level": {
                                "type": "token_count",
                                "store": true,
                                "analyzer": "path_level_analyzer",
                                "enable_position_increments": false
                            }
                        },
                        "analyzer": "ngram_analyzer"
                    }
                }
            }
        }
    }
}

提前感谢您的帮助。

问候，维卡斯

【问题讨论】：

标签： elasticsearch elasticsearch-5

【解决方案1】：

发现我的问题，我应该使用这个：

https://mycompanyelasticsearch.com/my-data/_search?q=volumeId:vol.fe502fc3c23246b51d1708d936facf5f AND dataType:"File" AND path:/folder2/*

没有双引号，然后就可以了。

【讨论】：