has_parent和has_child查詢總是返回空結果：ElasticSearch 2.1.1

Question

我在3節點集羣上安裝了elasticsearch 2.1.1。 以下是我與指數2種

{ 
"log-aggregation": { 
    "mappings": { 
     "application-logs": { 
      "_all": { 
       "enabled": true 
      }, 
      "_parent": { 
       "type": "webserver-logs" 
      }, 
      "_routing": { 
       "required": true 
      }, 
      "properties": { 
       "localhost": { 
        "type": "string", 
        "index": "not_analyzed", 
        "include_in_all": true 
       }, 
       "log_level": { 
        "type": "string", 
        "include_in_all": true 
       }, 
       "logging_class": { 
        "type": "string", 
        "include_in_all": true 
       }, 
       "logging_message": { 
        "type": "string", 
        "index": "no", 
        "include_in_all": true 
       }, 
       "origin": { 
        "type": "string", 
        "index": "not_analyzed", 
        "include_in_all": true 
       },      
       "request_date": { 
        "type": "date", 
        "format": "YYYY-MM-dd HH:mm:ss,SSS", 
        "include_in_all": true 
       }, 
       "request_time": { 
        "type": "long", 
        "include_in_all": true 
       }, 
       "request_timestamp": { 
        "type": "date", 
        "format": "epoch_millis", 
        "include_in_all": true 
       }, 
       "response_time": { 
        "type": "string" 
       }, 
       "response_timestamp": { 
        "type": "date", 
        "format": "epoch_millis", 
        "include_in_all": true 
       }, 
       "unique_id": { 
        "type": "string", 
        "index": "not_analyzed", 
        "include_in_all": true 
       } 
      } 
     }, 
     "webserver-logs": { 
      "_all": { 
       "enabled": true 
      }, 
      "_routing": { 
       "required": true 
      }, 
      "properties": { 
       "accept_type": { 
        "type": "string", 
        "index": "no", 
        "include_in_all": true 
       }, 
       "content_type": { 
        "type": "string", 
        "index": "no", 
        "include_in_all": true 
       }, 
       "http_method": { 
        "type": "string", 
        "include_in_all": true 
       }, 
       "http_protocol": { 
        "type": "string" 
       }, 
       "http_status": { 
        "type": "long", 
        "index": "analyzed", 
        "include_in_all": true 
       }, 
       "http_url": { 
        "type": "string" 
       }, 
       "localhost": { 
        "type": "string", 
        "index": "not_analyzed", 
        "include_in_all": true 
       }, 
       "origin": { 
        "type": "string", 
        "index": "not_analyzed", 
        "include_in_all": true 
       }, 
       "referrer": { 
        "type": "string", 
        "index": "no", 
        "include_in_all": true 
       }, 
       "request_timestamp": { 
        "type": "date", 
        "format": "epoch_millis", 
        "include_in_all": true 
       }, 
       "response_size": { 
        "type": "short", 
        "index": "no", 
        "include_in_all": true 
       }, 
       "timestamp": { 
        "type": "string" 
       }, 
       "unique_id": { 
        "type": "string", 
        "index": "not_analyzed", 
        "include_in_all": true 
       }, 
       "useragent": { 
        "type": "string", 
        "index": "no", 
        "include_in_all": true 
       } 
      } 
     } 
    } 
} 

}

以下是我創建索引的文檔。

POST在http://SERVERNAME:9200/log-aggregation/webserver-logs?routing=VlN6VQoEFHAAAEcxAUUAAAAC

{ 

「localhost」 的： 「svcdev104.imagitas.com」， 「原產地」： 「10.4.30.112」， 「UNIQUE_ID」： 「VlN6VQoEFHAAAEcxAUUAAAAC」， 「時間戳」 ： 「1448311381504」， 「http_method」： 「POST」， 「HTTP_URL」： 「/註冊/ V1 /保存」， 「http_protocol」： 「HTTP/1.1」， 「HTTP_STATUS」： 「500」， 「 response_size「：」137「， 」accept_type「：」application/json「， 」conte nt_type「：」application/json「， 」referrer「：」 - 「， 」useragent「：」Mozilla/5.0（Windows NT 6.1; WOW64）爲AppleWebKit/537.36（KHTML，例如Gecko）鉻/ 46.0.2490.86 Safari瀏覽器/ 537.36" }

http://SERVERNAME:9200/log-aggregation/application-logs?routing=VlN6VQoEFHAAAEcxAUUAAAAC&parent=VlN6VQoEFHAAAEcxAUUAAAAC POST

{ 

「本地主機」： 「svcdev104.imagitas.com」， 「原點「： 」鉻擴展：// aejoelaoggembcahagimdiliamlcdmfm「， 」UNIQUE_ID「： 」VlN6VQoEFHAAAEcxAUUAAAAC「， 」request_timestamp「： 」1448311331605「， 」response_timestamp「： 」1448311381609「， 」response_time「： 」4「， 」 request_date「：」2015-11-23 12：53：01,605「， 」log_lev EL「： 」WARN「， 」logging_class「： 」LoggingResponseInterceptor「， 」logging_message「： 」註冊數據的持久化失敗......「 }

現在，我運行has_child和has_parent查詢，而不是得到任何結果。我查詢每個類型，雖然取得成果，而不是當我運行has_child和has_parent查詢

下面是示例查詢 POST http://SERVERNAME:9200/log-aggregation/application-logs/_search

{ 

「查詢」：{ 「has_parent」：{ 「類型」： 「web服務器-日誌」， 「查詢」：{ 「匹配」：{ 「HTTP_STATUS」： 「500」 } } } } }

任何幫助將不勝感激。 謝謝 斯里蘭卡

Answer 1

你需要設置父母的_id，或者孩子沒有被映射到它。

所以你的第一個文檔中插入應該是這樣的：

POST http://SERVERNAME:9200/log-aggregation/webserver-logs/VlN6VQoEFHAAAEcxAUUAAAAC/?routing=VlN6VQoEFHAAAEcxAUUAAAAC 
{ 
    "localhost": "svcdev104.imagitas.com", 
    "origin": "10.4.30.112", 
    "unique_id": "VlN6VQoEFHAAAEcxAUUAAAAC", 
    "timestamp": "1448311381504", 
    "http_method": "POST", 
    "http_url": "/registration/v1/save", 
    "http_protocol": "HTTP/1.1", 
    "http_status": "500", 
    "response_size": "137", 
    "accept_type": "application/json", 
    "content_type": "application/json", 
    "referrer": "-", 
    "useragent": "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36" 
} 

然後你的查詢將正常工作。

這裏是我用來測試它的代碼：

http://sense.qbox.io/gist/ff5d4fcd6bca62853f2d506e0b81a7290ee727d7