这里是一个文档的结构,由弹性搜索API为退货:弹性搜索嵌套过滤
{ "process_name":"process01", "beat": { "hostname":"12345","name":"blablabla" }, }
过滤通过PROCESS_NAME很容易,但如何将host_name过滤,这是内部嵌套击败?
- 失败尝试1
{ "size":10000, "query" : { "bool" : { "should": [ { "match" : { "process_name" : "process01" } }, { "match" : { "process_name" : "process02" } } ], "must": [ { "match" : { beat: { "hostname":"12345" } } } ] } } }
错误消息1:
(失败的反序列化对象类型=类com.logshero.api.SearchApiRequest):
- 失败尝试2
{ "size":10000, "query" : { "bool" : { "should": [ { "match" : { "process_name" : "process01" } }, { "match" : { "process_name" : "process02" } } ], "must": [ { "match" : { "hostname":"12345" } } ] } } }
错误消息2:
{ “命中”:{ “总”:0, “MAX_SCORE”:空, “命中”:[] }}
它的工作!非常感谢! –