ElasticSearch ends with query

Question

我正在搜索以":1"结尾的kibana中的数据

我有一个像这样的数据集my_field:

skdjjsdk:jkdsjkd:123:1:1
skdjjsdk:jkdsjkd:123:2:12
skdjjsdk:jkdsjkd:123:1:33
skdjjsdk:jkdsjkd:123:1:01
skdjjsdk:jkdsjkd:123:2:2

我试着在kibana search中搜索

my_field: "*:1"
my_field: ":1$"

也尝试Elasticsearch查询DSL(在过滤器字段)

{
"query": {
"regexp": {
"my_field": {
"value": ".*:1"
}
}
}
}   

但是我正在匹配

skdjjsdk:jkdsjkd:123:1:1
skdjjsdk:jkdsjkd:123:1:33

但我只想要skdjjsdk:jkdsjkd:123:1:1

Answer 1

我使用分析器空格和通配符查询得到结果。

PUT idx_test
{
"mappings": {
"properties": {
"my_field" :{
"type": "text",
"analyzer": "whitespace"
}
}
}
}

POST idx_test/_doc/
{"my_field":"skdjjsdk:jkdsjkd:123:1:1"}
POST idx_test/_doc/
{"my_field":"skdjjsdk:jkdsjkd:123:2:12"}
POST idx_test/_doc/
{"my_field":"skdjjsdk:jkdsjkd:123:1:33"}
POST idx_test/_doc/
{"my_field":"skdjjsdk:jkdsjkd:123:1:01"}
POST idx_test/_doc/
{"my_field":"skdjjsdk:jkdsjkd:123:2:2"}

GET idx_test/_search
{
"query": {
"wildcard": {
"my_field": {
"value": "*:1"
}
}
}
}