GET query, what is the difference between adding .keyword and not adding .keyword, and why there is no result

GET production-index-info/index_info/_search
{
  "query": {
    "bool": {
      "minimum_should_match": 0,
      "must": [
        {
          "term": {
            "is_resolved.keyword": ""
          }
        }
      ],
      "should": []
    }
  }
}

query in this way, and you can get the data. The data is in the following format 

{
  "took": 51,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 2914867,
    "max_score": 0.26003557,
    "hits": [
      {
        "_index": "production-index-info",
        "_type": "index_info",
        "_id": "5a5d4fcdc42fbc2bcefae14a",
        "_score": 0.26003557,
        "_source": {
          "created_time": "2020-01-21T22:44:50+08:00",
          "tickets": [],
          "is_resolved": "",
          "note": "",
        }
      },
      {
        "_index": "production-index-info",
        "_type": "index_info",
        "_id": "5a64a762cd1cb23dbb294bfa",
        "_score": 0.26003557,
        "_source": {
          "created_time": "2018-01-21T22:44:50+08:00",
          "tickets": [],
          "is_resolved": "",
          "note": "",
        }
      },
      {
        "_index": "production-index-info",
        "_type": "index_info",
        "_id": "5a5d88136817b27825831ac2",
        "_score": 0.26003557,
        "_source": {
          "created_time": "2018-01-16T13:05:23+08:00",
          "tickets": [],
          "is_resolved": "",
          "note": "11111",
        }
      },
      {
        "_index": "production-index-info",
        "_type": "index_info",
        "_id": "5a5dbc30c42fbc2ef1307ba9",
        "_score": 0.26003557,
        "_source": {
          "created_time": "2018-01-16T16:47:44+08:00",
          "tickets": [],
          "is_resolved": "",
          "note": "222",
        }
      },
      ......
    ]
  }
}

but if you use this method, delete .keywprd , 

GET production-index-info/index_info/_search
{
  "query": {
    "bool": {
      "minimum_should_match": 0,
      "must": [
        {
          "term": {
            "is_resolved": ""
          }
        }
      ],
      "should": []
    }
  }
}

then the result is like this 

{
  "took": 0,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  }
}

I know that this .keyword is related to participle, but for this example, I don"t understand why. I can"t query the result without adding .keyword . In addition, there are only two values of is_resolved: resolved and unresolved.

Elk elastic-search elasticsearch
Feb.23,2022

1.ES5.0 and later versions cancel the string type, and divide the original string type into text and keyword types. The difference is that text performs word segmentation on fields while keyword does not.
2. When you do not pre-specify mapping for your index field in the form of IndexTemplate, etc., ES will use Dynamic Mapping, to dynamically map the field by deducing the value of the field in your incoming document. For example, if the value of the field price in the incoming document is 12, then price will be mapped to the long type; if the value of the field addr is "192.168.0.1", then addr will be mapped to the ip type. However, for ordinary strings that do not meet the ip and date formats, the situation is somewhat different: ES maps them to text types, but in order to retain the ability to accurately query and aggregate these fields, they are also mapped to keyword types, written to _ mapping as the ide/en/elasticsearch/reference/current/multi-fields.html" rel=" nofollow noreferrer "> fields attribute of the field. For example, when ES encounters a new field "foobar": "some string", it will do the following Dynamic Mapping:

to it 
{
    "foobar": {
        "type" "text",
        "fields": {
            "keyword": {
                "type": "keyword",
                "ignore_above": 256
            }
        }
    }
}

the use of foobar in subsequent queries is to use foobar as the text type query, while using foobar.keyword is to use foobar as the keyword type query. The former will match the query content after word segmentation, while the latter will match the query results directly.
3.ES 's ide/en/elasticsearch/reference/current/query-dsl-term-query.html" rel=" nofollow noreferrer "> term query does an exact match rather than a word segmentation query, so a term query on a field of type text will not find the result (unless the field itself remains unchanged after being processed by a word splitter and has not been converted or segmented). At this point, you must use foobar.keyword to exactly match the foobar field with the keyword type.

in general, keyword matches the fields exactly, but for the keyword= solution to find the solved cases, you need to post mapping to further analyze

did I ask to solve the same problem

?

Previous: How to implement the same Series of groups in eachart

Next: Electron prevents double-clicking of the mouse to enlarge the window

css mysql arrays josn react html typescript webpack npm sass R objective-c .net sql-server jquery python-3.x angularjs django angular excel regex iphone ajax linux xml pandas vba spring database wordpress string wpf xcode windows bash postgresql oracle multithreading eclipse list firebase algorithm macos forms image scala visual-studio azure bootstrap spring-boot react-native python-2.7 docker performance function winforms matlab powershell apache dataframe api sqlite numpy rest shell selenium flutter dart maven loops qt swing android-studio csv express file class tensorflow sorting codeigniter perl
© 2021 CodesHelper
Advertising Contact us About us
Menu