Elasticsearch 搜索 mac 地址 ruby​​ on rails

Question

我是 ror 和 elasticsearch 的新手。

我有我的模型。

class Ddhcpconf < ActiveRecord::Base
    include Tire::Model::Search
    include Tire::Model::Callbacks


    tire.mapping do
        indexes :mac, :index_analyser => 'keyword', :search_analyser => 'keyword'
        indexes :ip, :index_analyser => 'keyword', :search_analyser => 'keyword'
    end 

    def self.search(params)
        tire.search(load: true, page: params[:page], per_page: 15) do |s|
            s.query { string params[:query], default_operator: "AND"} if    params[:query].present?
            s.sort { by :ip, "asc" } if params[:query].blank?
        end
    end
end

我想搜索一个mac地址我得到这个错误：

400 : {"error":"SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[ekOgLtQNSSCtW0MgoPA6wQ][ddhcpconfs][2]: SearchParseException[[ddhcpconfs][2]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\"query\":{\"query_string\":{\"query\":\"00:14:22:47:41:9f\",\"default_operator\":\"AND\"}},\"size\":15}]]]; nested: QueryParsingException[[ddhcpconfs] Failed to parse query [00:14:22:47:41:9f]]; nested: ParseException[Cannot parse '00:14:22:47:41:9f': Encountered \" \":\" \": \"\" at line 1, column 5.\nWas expecting one of:\n <EOF> \n <AND> ...\n <OR> ...\n <NOT> ...\n \"+\" ...\n \"-\" ...\n <BAREOPER> ...\n \"(\" ...\n \"*\" ...\n \"^\" ...\n <QUOTED> ...\n <TERM> ...\n <FUZZY_SLOP> ...\n <PREFIXTERM> ...\n <WILDTERM> ...\n <REGEXPTERM> ...\n \"[\" ...\n \"{\" ...\n <NUMBER> ...\n ]; nested: ParseException[Encountered \" \":\" \": \"\" at line 1, column 5.\nWas expecting one of:\n <EOF> \n <AND> ...\n <OR> ...\n <NOT> ...\n \"+\" ...\n \"-\" ...\n <BAREOPER> ...\n \"(\" ...\n \"*\" ...\n \"^\" ...\n <QUOTED> ...\n <TERM> ...\n <FUZZY_SLOP> ...\n <PREFIXTERM> ...\n <WILDTERM> ...\n <REGEXPTERM> ...\n \"[\" ...\n \"{\" ...\n <NUMBER> ...\n ]; }{[ekOgLtQNSSCtW0MgoPA6wQ][ddhcpconfs][3]: SearchParseException[[ddhcpconfs][3]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\"query\":{\"query_string\":{\"query\":\"00:14:22:47:41:9f\",\"default_operator\":\"AND\"}},\"size\":15}]]]; nested: QueryParsingException[[ddhcpconfs] Failed to parse query [00:14:22:47:41:9f]]; nested: ParseException[Cannot parse '00:14:22:47:41:9f': Encountered \" \":\" \": \"\" at line 1, column 5.\nWas expecting one of:\n <EOF> \n <AND> ...\n <OR> ...\n <NOT> ...\n \"+\" ...\n \"-\" ...\n <BAREOPER> ...\n \"(\" ...\n \"*\" ...\n \"^\" ...\n <QUOTED> ...\n <TERM> ...\n <FUZZY_SLOP> ...\n <PREFIXTERM> ...\n <WILDTERM> ...\n <REGEXPTERM> ...\n \"[\" ...\n \"{\" ...\n <NUMBER> ...\n ]; nested: ParseException[Encountered \" \":\" \": \"\" at line 1, column 5.\nWas expecting one of:\n <EOF> \n <AND> ...\n <OR> ...\n <NOT> ...\n \"+\" ...\n \"-\" ...\n <BAREOPER> ...\n \"(\" ...\n \"*\" ...\n \"^\" ...\n <QUOTED> ...\n <TERM> ...\n <FUZZY_SLOP> ...\n <PREFIXTERM> ...\n <WILDTERM> ...\n <REGEXPTERM> ...\n \"[\" ...\n \"{\" ...\n <NUMBER> ...\n ]; }{[ekOgLtQNSSCtW0MgoPA6wQ][ddhcpconfs][4]: SearchParseException[[ddhcpconfs][4]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\"query\":{\"query_string\":{\"query\":\"00:14:22:47:41:9f\",\"default_operator\":\"AND\"}},\"size\":15}]]]; nested: QueryParsingException[[ddhcpconfs] Failed to parse query [00:14:22:47:41:9f]]; nested: ParseException[Cannot parse '00:14:22:47:41:9f': Encountered \" \":\" \": \"\" at line 1, column 5.\nWas expecting one of:\n <EOF> \n <AND> ...\n <OR> ...\n <NOT> ...\n \"+\" ...\n \"-\" ...\n <BAREOPER> ...\n \"(\" ...\n \"*\" ...\n \"^\" ...\n <QUOTED> ...\n <TERM> ...\n <FUZZY_SLOP> ...\n <PREFIXTERM> ...\n <WILDTERM> ...\n <REGEXPTERM> ...\n \"[\" ...\n \"{\" ...\n <NUMBER> ...\n ]; nested: ParseException[Encountered \" \":\" \": \"\" at line 1, column 5.\nWas expecting one of:\n <EOF> \n <AND> ...\n <OR> ...\n <NOT> ...\n \"+\" ...\n \"-\" ...\n <BAREOPER> ...\n \"(\" ...\n \"*\" ...\n \"^\" ...\n <QUOTED> ...\n <TERM> ...\n <FUZZY_SLOP> ...\n <PREFIXTERM> ...\n <WILDTERM> ...\n <REGEXPTERM> ...\n \"[\" ...\n \"{\" ...\n <NUMBER> ...\n ]; }{[ekOgLtQNSSCtW0MgoPA6wQ][ddhcpconfs][0]: SearchParseException[[ddhcpconfs][0]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\"query\":{\"query_string\":{\"query\":\"00:14:22:47:41:9f\",\"default_operator\":\"AND\"}},\"size\":15}]]]; nested: QueryParsingException[[ddhcpconfs] Failed to parse query [00:14:22:47:41:9f]]; nested: ParseException[Cannot parse '00:14:22:47:41:9f': Encountered \" \":\" \": \"\" at line 1, column 5.\nWas expecting one of:\n <EOF> \n <AND> ...\n <OR> ...\n <NOT> ...\n \"+\" ...\n \"-\" ...\n <BAREOPER> ...\n \"(\" ...\n \"*\" ...\n \"^\" ...\n <QUOTED> ...\n <TERM> ...\n <FUZZY_SLOP> ...\n <PREFIXTERM> ...\n <WILDTERM> ...\n <REGEXPTERM> ...\n \"[\" ...\n \"{\" ...\n <NUMBER> ...\n ]; nested: ParseException[Encountered \" \":\" \": \"\" at line 1, column 5.\nWas expecting one of:\n <EOF> \n <AND> ...\n <OR> ...\n <NOT> ...\n \"+\" ...\n \"-\" ...\n <BAREOPER> ...\n \"(\" ...\n \"*\" ...\n \"^\" ...\n <QUOTED> ...\n <TERM> ...\n <FUZZY_SLOP> ...\n <PREFIXTERM> ...\n <WILDTERM> ...\n <REGEXPTERM> ...\n \"[\" ...\n \"{\" ...\n <NUMBER> ...\n ]; }{[ekOgLtQNSSCtW0MgoPA6wQ][ddhcpconfs][1]: SearchParseException[[ddhcpconfs][1]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\"query\":{\"query_string\":{\"query\":\"00:14:22:47:41:9f\",\"default_operator\":\"AND\"}},\"size\":15}]]]; nested: QueryParsingException[[ddhcpconfs] Failed to parse query [00:14:22:47:41:9f]]; nested: ParseException[Cannot parse '00:14:22:47:41:9f': Encountered \" \":\" \": \"\" at line 1, column 5.\nWas expecting one of:\n <EOF> \n <AND> ...\n <OR> ...\n <NOT> ...\n \"+\" ...\n \"-\" ...\n <BAREOPER> ...\n \"(\" ...\n \"*\" ...\n \"^\" ...\n <QUOTED> ...\n <TERM> ...\n <FUZZY_SLOP> ...\n <PREFIXTERM> ...\n <WILDTERM> ...\n <REGEXPTERM> ...\n \"[\" ...\n \"{\" ...\n <NUMBER> ...\n ]; nested: ParseException[Encountered \" \":\" \": \"\" at line 1, column 5.\nWas expecting one of:\n <EOF> \n <AND> ...\n <OR> ...\n <NOT> ...\n \"+\" ...\n \"-\" ...\n <BAREOPER> ...\n \"(\" ...\n \"*\" ...\n \"^\" ...\n <QUOTED> ...\n <TERM> ...\n <FUZZY_SLOP> ...\n <PREFIXTERM> ...\n <WILDTERM> ...\n <REGEXPTERM> ...\n \"[\" ...\n \"{\" ...\n <NUMBER> ...\n ]; }]","status":400}

请帮忙....

谢谢

Answer 1

我用 '\:' 替换所有冒号，然后如果我使用属性搜索，我会替换第一个冒号，即：ip:172.30.5.85。

class Ddhcpconf < ActiveRecord::Base
    include Tire::Model::Search
    include Tire::Model::Callbacks


    tire.mapping do
        indexes :nomdns, :index_analyser => 'keyword', :search_analyser => 'keyword'
        indexes :ddns, :index_analyser => 'keyword', :search_analyser => 'keyword'
        indexes :comment, :index_analyser => 'keyword', :search_analyser => 'keyword'
        indexes :zonedhcp, :index_analyser => 'keyword', :search_analyser => 'keyword'
        indexes :mac, :index_analyser => 'keyword', :search_analyser => 'keyword'
        indexes :ip, :index_analyser => 'keyword', :search_analyser => 'keyword'
    end

    def self.search(params)
        if params[:query].present?
            if params[:query] =~ /^ip:/ || params[:query] =~ /^mac:/ || params[:query] =~ /^zonedhcp:/ || params[:query] =~ /^comment:/ || params[:query] =~ /^ddns:/ || params[:query] =~ /^nomdns:/
                recherche = params[:query].gsub(/:/, '\:')
                recherche = recherche.sub(/^([^:]+)\\:/, '\1:')
            else
                recherche = '"' + params[:query].gsub(/:/, '\:') + '"'
            end
        end
        tire.search(load: true, page: params[:page], per_page: 15) do |s|
            s.query { string params[:query], default_operator: "AND"} if params[:query].present?
            s.sort { by :ip, "asc" } if params[:query].blank? || params[:query].present?
        end
    end
end

感谢@geeky_sh

Answer 2

当您搜索特定的mac地址时，您应该使用term查询来查找结果。这是因为，术语查询不分析查询字段（在这种情况下是您的 mac 地址）。这是弹性搜索查询：

query: {
  term: {
    mac: '//your mac address..'
  }
}

轮胎查询：

def self.search(params)
  tire.search(load: true, page: params[:page], per_page: 15) do |s|
     s.query { term :mac, params[:query]} if params[:query].present?
  end
end

更新：

我检查了您的问题，并找到了解决方案。您的问题是您正在为您的mac地址设置keyword_analyzer。请改用keyword。它应该可以正常工作。

我建议您使用term query，因为它不会分析您使用搜索的术语。

请注意，通过为 mac 设置 keyword 分析器。地址。只有输入整个mac才能搜索ES文档。地址。