ElasticSearch以查询结束

swvgeqrz  于 2022-12-22  发布在  ElasticSearch
关注(0)|答案(1)|浏览(110)

我正在kibana中搜索以“:1”结尾的数据
对于my_field,我有一个类似的数据集:

skdjjsdk:jkdsjkd:123:1:1
skdjjsdk:jkdsjkd:123:2:12
skdjjsdk:jkdsjkd:123:1:33
skdjjsdk:jkdsjkd:123:1:01
skdjjsdk:jkdsjkd:123:2:2

我试着在Kibana搜索

my_field: "*:1"
my_field: ":1$"

我也尝试了Elasticsearch查询DSL(在过滤器字段中)

{
  "query": {
    "regexp": {
      "my_field": {
        "value": ".*:1"
      }
    }
  }
}

但我正在和

skdjjsdk:jkdsjkd:123:1:1
skdjjsdk:jkdsjkd:123:1:33

但我只要skdjjsdk:jkdsjkd:123:1:1

bxgwgixi

bxgwgixi1#

我使用分析器空格和通配符查询获得结果。

PUT idx_test
{
 "mappings": {
   "properties": {
     "my_field" :{
       "type": "text",
       "analyzer": "whitespace"
     }
   }
 }
}

POST idx_test/_doc/
{"my_field":"skdjjsdk:jkdsjkd:123:1:1"}

POST idx_test/_doc/
{"my_field":"skdjjsdk:jkdsjkd:123:2:12"}

POST idx_test/_doc/
{"my_field":"skdjjsdk:jkdsjkd:123:1:33"}

POST idx_test/_doc/
{"my_field":"skdjjsdk:jkdsjkd:123:1:01"}

POST idx_test/_doc/
{"my_field":"skdjjsdk:jkdsjkd:123:2:2"}

GET idx_test/_search
{
  "query": {
   "wildcard": {
     "my_field": {
       "value": "*:1"
     }
   }
  }
}

相关问题