我的index如下:
{
"logstash-yarn-running": {
"aliases": {},
"mappings": {
"yarn.running": {
"properties": {
"appId": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
我需要查询appId=job_1539235866732_0049的记录
以下是存在es里的一条记录 该条记录appId=job_1539235866732_0049
{
"_index" : "logstash-yarn-running",
"_type" : "yarn.running",
"_id" : "IpjaNmgB20nR4pazz9LE",
"_score" : 1.0,
"_source" : {
"appId" : "application_1539235866732_0049",
"appName" : "QuasiMonteCarlo",
"appType" : "MAPREDUCE",
"appState" : "RUNNING",
"finalStatus" : "UNDEFINED",
"vcores" : 4,
"memory" : 16384,
"queue" : "root.default",
"user" : "hdfs",
"vcoreSeconds" : 35,
"memorySeconds" : 154327,
"elapsedTime" : 15,
"finishedTime" : "1970-01-01T08:00:00.000+08:00",
"logDate" : "2019-01-10T16:22:15.042+08:00",
"category" : "yarn.running"
}
}
我的查询api及返回如下:
# curl -H 'Content-Type: application/json' -XPOST http://x.x.x.x:9200/logstash-y ... retty -d '{
> "query": {
> "match": {
> "appId": "job_1539235866732_0049"
> }
> }
> }'
{
"took" : 3,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : null,
"hits" : [ ]
}
}
有那条记录确返回空 求教这是为什么
{
"logstash-yarn-running": {
"aliases": {},
"mappings": {
"yarn.running": {
"properties": {
"appId": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
我需要查询appId=job_1539235866732_0049的记录
以下是存在es里的一条记录 该条记录appId=job_1539235866732_0049
{
"_index" : "logstash-yarn-running",
"_type" : "yarn.running",
"_id" : "IpjaNmgB20nR4pazz9LE",
"_score" : 1.0,
"_source" : {
"appId" : "application_1539235866732_0049",
"appName" : "QuasiMonteCarlo",
"appType" : "MAPREDUCE",
"appState" : "RUNNING",
"finalStatus" : "UNDEFINED",
"vcores" : 4,
"memory" : 16384,
"queue" : "root.default",
"user" : "hdfs",
"vcoreSeconds" : 35,
"memorySeconds" : 154327,
"elapsedTime" : 15,
"finishedTime" : "1970-01-01T08:00:00.000+08:00",
"logDate" : "2019-01-10T16:22:15.042+08:00",
"category" : "yarn.running"
}
}
我的查询api及返回如下:
# curl -H 'Content-Type: application/json' -XPOST http://x.x.x.x:9200/logstash-y ... retty -d '{
> "query": {
> "match": {
> "appId": "job_1539235866732_0049"
> }
> }
> }'
{
"took" : 3,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : null,
"hits" : [ ]
}
}
有那条记录确返回空 求教这是为什么
4 个回复
elasticStack - 90后it大数据男
赞同来自: xiaoman
God_lockin
赞同来自: xiaoman
"appId" : "application_1539235866732_0049",
吗?
然后拿
"value": "job_1539235866732_0049"
搜
用默认的mapping的话,这一串不会分词,会被当成一个字(词)去做匹配,明显搜不出来啊
{
"wildcard": {
"appId": "*_1539235866732_0049"
}
}
目测只能这样搜
shine - Elastic coder,云计算
赞同来自: xiaoman
解决方法: 可使用term检索,即不对检索词切分,而是作为整体去匹配。
zqc0512 - andy zhou
赞同来自: xiaoman