ElasticSearch查詢字段是否有值？

Question

我有這樣的文件：

{ 
    "took": 1, 
    "timed_out": false, 
    "_shards": {...}, 
    "hits": { 
    "total": 20584, 
    "max_score": 8.143582, 
    "hits": [ 
     { 
     "_index": "nyc_visionzero", 
     "_type": "logs", 
     "_id": "AVwMozs3iTTcr81oIxfl", 
     "_score": 8.143582, 
     "_source": { 
      "date": "02/12/2017", 
      "number_of_motorist_injured": 2, 
      "contributing_factor_vehicle": "Unsafe Speed", 
     } 
     ... 

我想所有那些領域contributing_factor_vehicle包含文本unsafe，如果我執行此查詢：

{ 
    "query":{ 
    "query_string": { 
     "query": "unsafe" 
    } 
    } 
} 

它返回一個包含所有結果不安全，但我想限制它到字段contributing_factor_vehicle。

更新映射

{ 
    "nyc_visionzero": { 
    "mappings": { 
     "logs": { 
     "_all": { 
      "enabled": true 
     }, 
     "dynamic_templates": [ 
      { 
      "string_fields": { 
       "match": "*", 
       "match_mapping_type": "string", 
       "mapping": { 
       "fields": { 
        "raw": { 
        "ignore_above": 256, 
        "type": "keyword" 
        } 
       }, 
       "omit_norms": true, 
       "type": "text" 
       } 
      } 
      } 
     ], 
     "properties": { 
      "@timestamp": { 
      "type": "date" 
      }, 
      "@version": { 
      "type": "keyword" 
      }, 
      "borough": { 
      "type": "keyword" 
      }, 
      "contributing_factor_vehicle": { 
      "type": "keyword" 
      }, 
      "coords": { 
      "type": "geo_point" 
      }, 
      "cross_street_name": { 
      "type": "keyword" 
      }, 
      "date": { 
      "type": "text", 
      "norms": false, 
      "fields": { 
       "raw": { 
       "type": "keyword", 
       "ignore_above": 256 
       } 
      } 
      }, 
      "host": { 
      "type": "text", 
      "norms": false, 
      "fields": { 
       "raw": { 
       "type": "keyword", 
       "ignore_above": 256 
       } 
      } 
      }, 
      "hour_of_day": { 
      "type": "integer" 
      }, 
      "intersection": { 
      "type": "keyword" 
      }, 
      "latitude": { 
      "type": "text", 
      "norms": false, 
      "fields": { 
       "raw": { 
       "type": "keyword", 
       "ignore_above": 256 
       } 
      } 
      }, 
      "location": { 
      "type": "text", 
      "norms": false, 
      "fields": { 
       "raw": { 
       "type": "keyword", 
       "ignore_above": 256 
       } 
      } 
      }, 
      "longitude": { 
      "type": "text", 
      "norms": false, 
      "fields": { 
       "raw": { 
       "type": "keyword", 
       "ignore_above": 256 
       } 
      } 
      }, 
      "message": { 
      "type": "text", 
      "norms": false, 
      "fields": { 
       "raw": { 
       "type": "keyword", 
       "ignore_above": 256 
       } 
      } 
      }, 
      "number_of_cyclist_injured": { 
      "type": "long" 
      }, 
      "number_of_cyclist_killed": { 
      "type": "long" 
      }, 
      "number_of_motorist_injured": { 
      "type": "long" 
      }, 
      "number_of_motorist_killed": { 
      "type": "long" 
      }, 
      "number_of_pedestrians_injured": { 
      "type": "long" 
      }, 
      "number_of_pedestrians_killed": { 
      "type": "long" 
      }, 
      "number_of_persons_injured": { 
      "type": "long" 
      }, 
      "number_of_persons_killed": { 
      "type": "long" 
      }, 
      "number_persons_impacted": { 
      "type": "long" 
      }, 
      "off_street_name": { 
      "type": "keyword" 
      }, 
      "on_street_name": { 
      "type": "keyword" 
      }, 
      "query": { 
      "properties": { 
       "match_all": { 
       "type": "object" 
       } 
      } 
      }, 
      "tags": { 
      "type": "text", 
      "norms": false, 
      "fields": { 
       "raw": { 
       "type": "keyword", 
       "ignore_above": 256 
       } 
      } 
      }, 
      "time": { 
      "type": "text", 
      "norms": false, 
      "fields": { 
       "raw": { 
       "type": "keyword", 
       "ignore_above": 256 
       } 
      } 
      }, 
      "unique_key": { 
      "type": "text", 
      "norms": false, 
      "fields": { 
       "raw": { 
       "type": "keyword", 
       "ignore_above": 256 
       } 
      } 
      }, 
      "vehicle_type": { 
      "type": "text", 
      "norms": false, 
      "fields": { 
       "raw": { 
       "type": "keyword", 
       "ignore_above": 256 
       } 
      } 
      }, 
      "zip_code": { 
      "type": "text", 
      "norms": false, 
      "fields": { 
       "raw": { 
       "type": "keyword", 
       "ignore_above": 256 
       } 
      } 
      } 
     } 
     } 
    } 
    } 
} 

Answer 1

由於contributing_factor_vehicle字段是keyword類型，這意味着值不會得到analyzed和因爲它們將被存儲的。

有兩種方法可以解決這個問題。或者使用下面的查詢搜索的精確匹配：

"query": { 
    "term": { 
     "contributing_factor_vehicle": { 
      "value": "Unsafe Speed" <--- Exact Term (check case) 
     } 
     } 
    } 

，或者如果你不想不區分大小寫創建contributing_factor_vehicle爲萬事默認情況下是在ES 5或者你自己創建它，如果你的版本是< 5.x

POST index 
{ 
    "mappings": { 
    "type": { 
    "properties": { 
     "contributing_factor_vehicle": { 
      "type": "string", 
      "fields": { 
       "raw": { 
       "type": "string", 
       "index": "not_analyzed" 
       } 
      } 
     } 
     } 
     } 
    }} 

然後你可以這樣查詢。 ：

{ 
    "query":{ 
     "query_string": { 
     "query": "unsafe", 
     "default_field" : "contributing_factor_vehicle" 

    } 
    } 
}