如何过滤每个索引在一个查询与弹性的两个索引?

Question

我正在尝试进行查询以获取Elastic中两个不同索引的信息:

GET _search
{
"query": {
"bool": {
"must" : [{
"bool" : {
"should" : [{
"match" : {
"action": "VoiceQueueAbandonAction"
}},
{ 
"match" : {
"action": "QualifyVoiceWel"
} 
}     
]
}
}
],
"filter": {
"range": {
"created_at": {
"gte": "2022-05-04 00:00:00",
"lte": "2022-05-04 23:59:59"
}
}
}
}
}
}

它是正确的，但是它复制了信息，因为在索引&;qualification &;和";queueevents"有相同的动作" qualifyvoicewell "

在本例中，我需要过滤QualifyVoiceWel"字段仅来自资格索引，而不是来自queueevents !

Answer 1

您可以在现有的should中添加bool子句，如下所示:

{
"query": {
"bool": {
"must": [
{
"bool": {
"should": [
{
"match": {
"action": "VoiceQueueAbandonAction"
}
},
{
"bool": {
"must": [
{
"match": {
"action": "QualifyVoiceWel"
}
},
{
"term": {
"_index": {
"value": "qualifications"
}
}
}
]
}
}
]
}
}
],
"filter": {
"range": {
"created_at": {
"gte": "2022-05-04 00:00:00",
"lte": "2022-05-04 23:59:59"
}
}
}
}
}
}

Answer 2

根据您的需求有两种选择:

• 查询正确的索引//_search

或

• 索引名称可用于查询_index。这个文档提供了更多的细节