如何从elasticSearch查询结果中搜索_source中的特定值？

问题描述

我正在通过Elastic Search收集日志。然后通过查询查询结果。

查询以下查询时

GET test/_search
{
  "query": {
    "match_all":{
    }
  }
}

查询结果如下。

{
  "took" : 0,"timed_out" : false,"_shards" : {
    "total" : 1,"successful" : 1,"skipped" : 0,"Failed" : 0
  },"hits" : {
    "total" : {
      "value" : 100,"relation" : "eq"
    },"max_score" : 1.0,"hits" : [
      {
        "_index" : "test","_id" : "1a2b3c4d5e6f","_score" : 1.0,"_source" : {
          "team" : "Marketing"
          "number" : "3"
          "name" : "Mark"
        }
      },{
        "_index" : "test","_id" : "1a2b3c4d5e66","_source" : {
          "team" : "HR"
          "number" : "1"
          "name" : "John"
        }
      },........

但是，我想按以下方式查询。（Inner_hits的特定值）

{
    "name": "Mark"
},{
    "name": "John"
},

那么，如何查询特定值inner_hits？

谢谢。

解决方法

您可以简单地使用ES的source_filtering feature，因此在您的情况下，您的查询将如下所示：

{
    "_source": "name","query": {
        "match_all": {}
    }
}

它返回类似的搜索结果

"hits": [
            {
                "_index": "64214413","_type": "_doc","_id": "1","_score": 1.0,"_source": {
                    "name": "Mark"
                }
            },{
                "_index": "64214413","_id": "2","_source": {
                    "name": "John"
                }
            }
        ]