难以结合布尔和范围查询，弹性搜索

Question

我在理解弹性搜索中嵌套查询的各种方法时遇到了一些麻烦。这是我的索引数据的示例。

{
    "Underlying" : "Eurodollar",
    "Expiration" : "20160315"
},
{
    "Underlying" : "Eurodollar",
    "Expiration" : "20160415"
},
{
    "Underlying" : "Eurodollar",
    "Expiration" : "20160515"
}

所以，我能够运行这样的查询

{
    "query" : {
        "range" : {
            "Expiration" : {
                "gte" : "20160315",
                "lte" : "20160515"
            }
        }
    }
}

正如预期的那样，我得到了所有条目。但是，假设我也有这样的索引条目。

{
   "Underlying" : "Something else",
   "Expiration" : "20160415"
}

我不希望“其他”结果返回，所以我现在尝试做这样的事情。

{
    "query" : {
        "bool" : {
            "must" : [
                {
                    "term" : {
                        "Underlying" : {
                            "value" : "eurodollar"
                        }
                    }
                }
            ]
        },
        "range" : {
            "Expiration" : {
                "gte" : "20160315",
                "lte" : "20160515"
            }
        }
    }
}

但我遇到了一个错误

RequestError(400, u'SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[cCrh939sR7yHdKgawRi6Sw][test-index][0]: SearchParseException[[test-index][0]: query[Expiration:[20160215 TO 20160415]],from[-1],size[-1]: Parse Failure [Failed to parse source [{"query": {"range": {"Expiration": {"gte": "20160215", "lte": "20160415"}}, "bool": {"must": [{"term": {"Underlying": {"value": "eurodollar"}}}]}}}]]]; nested: ElasticsearchParseException[Expected field name but got START_OBJECT "bool"]; }{[cCrh939sR7yHdKgawRi6Sw][test-index][1]: SearchParseException[[test-index][1]: query[Expiration:[20160215 TO 20160415]],from[-1],size[-1]: Parse Failure [Failed to parse source [{"query": {"range": {"Expiration": {"gte": "20160215", "lte": "20160415"}}, "bool": {"must": [{"term": {"Underlying": {"value": "eurodollar"}}}]}}}]]]; nested: ElasticsearchParseException[Expected field name but got START_OBJECT "bool"]; }]', {u'status': 400, u'error': u'SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[cCrh939sR7yHdKgawRi6Sw][test-index][0]: SearchParseException[[test-index][0]: query[Expiration:[20160215 TO 20160415]],from[-1],size[-1]: Parse Failure [Failed to parse source [{"query": {"range": {"Expiration": {"gte": "20160215", "lte": "20160415"}}, "bool": {"must": [{"term": {"Underlying": {"value": "eurodollar"}}}]}}}]]]; nested: ElasticsearchParseException[Expected field name but got START_OBJECT "bool"]; }{[cCrh939sR7yHdKgawRi6Sw][test-index][1]: SearchParseException[[test-index][1]: query[Expiration:[20160215 TO 20160415]],from[-1],size[-1]: Parse Failure [Failed to parse source [{"query": {"range": {"Expiration": {"gte": "20160215", "lte": "20160415"}}, "bool": {"must": [{"term": {"Underlying": {"value": "eurodollar"}}}]}}}]]]; nested: ElasticsearchParseException[Expected field name but got START_OBJECT "bool"]; }]'})

错误最相关的文本似乎是这个

 Expected field name but got START_OBJECT "bool"

我知道我的 bool/term 查询正在运行，因为我只运行了这个

{
    "query" : {
        "bool" : {
            "must" : [
                {
                    "term" : {
                        "Underlying" : {
                            "value" : "eurodollar"
                        }
                    }
                }
            ]
        }
    }
}

我得到了预期的结果。

我认为这很好地说明了我的情况。鉴于我对如何组合它们的猜测不正确，我该如何正确组合这些查询。

Answer 1

您的范围查询必须在 must 子句内：

{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "Underlying": {
              "value": "eurodollar"
            }
          }
        },
        {
          "range": {
            "Expiration": {
              "gte": "20160315",
              "lte": "20160515"
            }
          }
        }
      ]
    }
  }
}

您可以将不同的查询与bool 查询结合起来。它包含 4 个不同的子句：must、should、not_must 和 filter。

filter 与 must 相同。差异是过滤器的分数不计算在内。

基本结构是（取自doc）：

{
  "bool": {
    "must": {
      "term": { "user": "kimchy" }
    },
    "filter": {
      "term": { "tag": "tech" }
    },
    "must_not": { <= single inside query
      "range": {
        "age": { "from": 10, "to": 20 }
      }
    },
    "should": [   <= that is an array,
      {           <= start of inner query is important
        "term": { "tag": "wow" }
      },
      {
        "term": { "tag": "elasticsearch" }
      }
    ]
  }
}