是我的查詢中有任何錯誤.Nest彈性C＃

Question

我的.Nest庫查詢有什麼問題嗎？我的查詢將獲得所有數據，我需要通過多項術語獲得。 查詢字符串彈性的結果，我想：

{ 
    "took": 2, 
    "timed_out": false, 
    "_shards": { 
     "total": 5, 
     "successful": 5, 
     "failed": 0 
    }, 
    "hits": { 
     "total": 1000, 
     "max_score": 0, 
     "hits": [] 
    }, 
    "aggregations": { 
     "log_query": { 
     "doc_count": 2, 
     "histogram_Log": { 
      "buckets": [ 
       { 
        "key_as_string": "06/02/2015 12:00:00", 
        "key": 1423180800000, 
        "doc_count": 1 
       }, 
       { 
        "key_as_string": "21/02/2015 12:00:00", 
        "key": 1424476800000, 
        "doc_count": 1 
       } 
      ] 
     } 
     } 
    } 
} 

我的查詢字符串彈性：

{ 
    "size": 0, 
    "aggs": { 
    "log_query": { 
     "filter": { 
     "bool": { 
      "must": [ 
      { 
       "term": { 
       "cluster": "giauht1" 
       } 
      }, 
      { 
       "term": { 
       "server": "hadoop0" 
       } 
      }, 
      { 
       "term": { 
       "type": "Warn" 
       } 
      }, 
      { 
       "range": { 
       "actionTime": { 
        "gte": "2015-02-01", 
        "lte": "2015-02-24" 
       } 
       } 
      } 
      ] 
     } 
     }, 
     "aggs": { 
     "histogram_Log": { 
      "date_histogram": { 
      "field": "actionTime", 
      "interval": "1d", 
      "format": "dd/MM/YYYY hh:mm:ss" 
      } 
     } 
     } 
    } 
    } 
} 

我.nest庫查詢：

Func<SearchDescriptor<LogInfoIndexView>, SearchDescriptor<LogInfoIndexView>> query = 
       que => que.Aggregations(aggs => aggs.Filter("log_query", fil => 
       { 
        fil.Filter(fb => fb.Bool(fm => fm.Must(
         ftm => 
         { 
          ftm.Term(t => t.Cluster, cluster); 
          ftm.Term(t => t.Server, server); 
          ftm.Term(t => t.Type, logLevel); 
          ftm.Range(r => r.OnField("actionTime").GreaterOrEquals(from.Value).LowerOrEquals(to.Value)); 
          return ftm; 
         }))).Aggregations(faggs => faggs.DateHistogram("histogram_Log", dr => 
        { 
         dr.Field("actionTime"); 
         dr.Interval("1d"); 
         dr.Format("dd/MM/YYYY hh:mm:ss"); 
         return dr; 
        })); 
        return fil; 
       })).Size(0).Type(new LogInfoIndexView().TypeName); 
      var result = client.Search(query); 

我.nest結果：

我的模型映射：

{ 
    "onef-sora": { 
     "mappings": { 
     "FPT.OneF.Api.Log": { 
      "properties": { 
       "actionTime": { 
        "type": "date", 
        "format": "dateOptionalTime" 
       }, 
       "application": { 
        "type": "string", 
        "index": "not_analyzed" 
       }, 
       "cluster": { 
        "type": "string", 
        "index": "not_analyzed" 
       }, 
       "detail": { 
        "type": "string", 
        "index": "not_analyzed" 
       }, 
       "iD": { 
        "type": "string" 
       }, 
       "message": { 
        "type": "string", 
        "index": "not_analyzed" 
       }, 
       "server": { 
        "type": "string", 
        "index": "not_analyzed" 
       }, 
       "source": { 
        "type": "string", 
        "index": "not_analyzed" 
       }, 
       "tags": { 
        "type": "string", 
        "index": "not_analyzed" 
       }, 
       "type": { 
        "type": "string", 
        "index": "not_analyzed" 
       }, 
       "typeLog": { 
        "type": "string" 
       }, 
       "typeName": { 
        "type": "string" 
       }, 
       "url": { 
        "type": "string", 
        "index": "not_analyzed" 
       }, 
       "user": { 
        "type": "string", 
        "index": "not_analyzed" 
       } 
      } 
     } 
     } 
    } 
} 

Answer 1

的Must()條件傳遞給Bool()過濾器需要params Func<FilterDescriptor<T>, FilterContainer>[]但在你的過濾器，該Term()和Range()過濾器鏈接到同一個過濾器實例;不幸的是，這也不行，你可能期待最終的結果實際上是傳遞給must子句中的查詢的DSL即你最終

{ 
    "size": 0, 
    "aggs": { 
    "log_query": { 
     "filter": { 
     "bool": { 
      "must": [ 
      {} /* where are the filters?! */ 
      ] 
     } 
     }, 
     "aggs": { 
     "histogram_Log": { 
      "date_histogram": { 
      "field": "actionTime", 
      "interval": "1d", 
      "format": "dd/MM/YYYY hh:mm:ss" 
      } 
     } 
     } 
    } 
    } 
} 

的解決方案是在過濾器的空JSON對象通過一組Func<FilterDescriptor<T>, FilterContainer>;以下匹配您的查詢DSL

void Main() 
{ 
    var settings = new ConnectionSettings(new Uri("http://localhost:9200")); 
    var connection = new InMemoryConnection(settings); 
    var client = new ElasticClient(connection: connection); 

    DateTime? from = new DateTime(2015, 2,1); 
    DateTime? to = new DateTime(2015, 2, 24); 

    var docs = client.Search<LogInfoIndexView>(s => s 
     .Size(0) 
     .Type("type") 
     .Aggregations(a => a 
      .Filter("log_query", f => f 
       .Filter(ff => ff 
        .Bool(b => b 
         .Must(m => m 
          .Term(t => t.Cluster, "giauht1"), 
           m => m 
          .Term(t => t.Server, "hadoop0"), 
           m => m 
          .Term(t => t.Type, "Warn"), 
           m => m 
          .Range(r => r.OnField("actionTime").GreaterOrEquals(from.Value).LowerOrEquals(to.Value)) 
         ) 
        ) 
       ) 
       .Aggregations(aa => aa 
        .DateHistogram("histogram_Log", da => da 
         .Field("actionTime") 
         .Interval("1d") 
         .Format("dd/MM/YYYY hh:mm:ss") 
        ) 
       ) 
      ) 
     ) 
    ); 

    Console.WriteLine(Encoding.UTF8.GetString(docs.RequestInformation.Request)); 
} 

public class LogInfoIndexView 
{ 
    public string Cluster { get; set; } 
    public string Server { get; set; } 
    public string Type { get; set; } 
    public DateTime ActionTime { get; set; }  
} 

返回

{ 
    "size": 0, 
    "aggs": { 
    "log_query": { 
     "filter": { 
     "bool": { 
      "must": [ 
      { 
       "term": { 
       "cluster": "giauht1" 
       } 
      }, 
      { 
       "term": { 
       "server": "hadoop0" 
       } 
      }, 
      { 
       "term": { 
       "type": "Warn" 
       } 
      }, 
      { 
       "range": { 
       "actionTime": { 
        "lte": "2015-02-24T00:00:00.000", 
        "gte": "2015-02-01T00:00:00.000" 
       } 
       } 
      } 
      ] 
     } 
     }, 
     "aggs": { 
     "histogram_Log": { 
      "date_histogram": { 
      "field": "actionTime", 
      "interval": "1d", 
      "format": "dd/MM/YYYY hh:mm:ss" 
      } 
     } 
     } 
    } 
    } 
} 

編輯：

在回答您的意見，一個filtered query filter和filter aggregation之間的區別在於，前者適用於過濾對查詢階段開始時的所有文檔和過濾器通常進行緩存，從而提高後續使用這些過濾器的查詢的性能，而後者適用於第用於將當前上下文中的文檔過濾到單個存儲桶的聚合範圍。如果您的查詢只執行聚合，並且您可能使用相同的過濾器運行聚合，我認爲filtered query filter應該提供更好的性能。