Elasticsearch 按字段过滤结果

Question

我是 dsl 新手，这看起来很简单。代码应在指定的日期范围内按小时计算总条目数。我添加了一个bool，这样结果应该有一个名为“消息”的字段，其中应该包含“[成功”

GET sample_index/_search
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "message": "[sucess"
          }
        }
      ]
    },
    "range": {
      "timestamp": {
        "gte": "2021-01-01",
        "lte": "2021-01-10"
      }
    }
  }, 
  "aggs": {
    "hit_count_per_day": {
      "date_histogram": {
        "field": "timestamp",
        "calendar_interval": "hour"
      }
    }
  }
}

返回的错误是

  {
  "error" : {
    "root_cause" : [
      {
        "type" : "parsing_exception",
        "reason" : "[bool] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
        "line" : 13,
        "col" : 5
      }
    ],
    "type" : "parsing_exception",
    "reason" : "[bool] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
    "line" : 13,
    "col" : 5
  },
  "status" : 400
}

Answer 1

您还需要在must 子句中包含range 查询。如下所示修改您的查询

{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "message": "[sucess"
          }
        },
        {
          "range": {
            "timestamp": {
              "gte": "2021-01-01",
              "lte": "2021-01-10"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "hit_count_per_day": {
      "date_histogram": {
        "field": "timestamp",
        "calendar_interval": "hour"
      }
    }
  }
}