ES中的文档如下所示
{
"indicator": "27.213.61.96",
"itype": "ipv4",
}
{
"indicator": "http://27.213.61.96:44375/Mozi.m",
"itype": "url",
}希望获得“指示符”:"27.213.61.96“对象,并为此尝试使用match_phrase、术语查询和constant_score查询,如下所示
{
"query" : {
"constant_score" : {
"filter" : {
"term" : {
"indicator" : "27.213.61.96"
}
}
}
}
}
{
"query": {
"term": {
"indicator": "27.213.61.96"
}
}
}作为响应,获得两个对象,但只想在响应对象下面。有什么办法能弄明白吗。映射是默认的映射,以及在不更改映射的情况下获取异常结果的任何方法。
{
"indicator": "27.213.61.96",
"itype": "ipv4",
}发布于 2020-11-20 02:26:52
您需要将.keyword添加到indicator字段。这使用关键字分析器而不是标准分析器(注意".keyword"后的indicator字段)。试试下面的查询-
{
"query": {
"term": {
"indicator.keyword": "27.213.61.96"
}
}
}搜索结果:
"hits": [
{
"_index": "64922836",
"_type": "_doc",
"_id": "1",
"_score": 1.0,
"_source": {
"indicator": "27.213.61.96",
"itype": "ipv4"
}
}
]https://stackoverflow.com/questions/64922836
复制相似问题