elasticsearch学习笔记（二十四）——Elasticsearch query string语法以及_all元数据原理

1、query string 语法

GET /test_index/_search?q=test_field1:update
GET /test_index/_search?q=+test_field1:update

{
  "took" : 7,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 0.2876821,
    "hits" : [
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "3",
        "_score" : 0.2876821,
        "_source" : {
          "test_field1" : "update test1",
          "test_field2" : "update test2"
        }
      }
    ]
  }
}

GET /test_index/_search?q=-test_field1:update
{
  "took" : 12,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 7,
      "relation" : "eq"
    },
    "max_score" : 0.0,
    "hits" : [
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "10",
        "_score" : 0.0,
        "_source" : {
          "test_field" : "test10 routing _id"
        }
      },
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "7",
        "_score" : 0.0,
        "_routing" : "2",
        "_source" : {
          "test_field1" : "test1"
        }
      },
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 0.0,
        "_source" : {
          "test_field" : "test client 1",
          "name" : "test1"
        }
      },
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 0.0,
        "_source" : {
          "test_field" : "test test",
          "name" : "test1"
        }
      },
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "7",
        "_score" : 0.0,
        "_routing" : "1",
        "_source" : {
          "test_field1" : "test1"
        }
      },
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "11",
        "_score" : 0.0,
        "_routing" : "12",
        "_source" : {
          "test_field" : "test routing not _id"
        }——
      },
      {
        "_index" : "test_index",
        "_type" : "_doc",
        "_id" : "20",
        "_score" : 0.0,
        "_source" : {
          "test_field" : "test consistency"
        }
      }
    ]
  }
}

对于query string只要掌握q=field:search content的语法，以及+和-的含义
+：代表包含这个筛选条件结果
-：代表不包含这个筛选条件的结果

2、_all metadata

也就是在使用query string的时候，如果不指定field，那么默认就是_all。_all元数据是在建立索引的时候产生的，我们插入一条document，它里面包含了多个field,此时ES会自动将多个field的值全部用字符串的方式串联起来，变成一个长的字符串。这个长的字符串就是_all field的值。同时建立索引。
举个例子：
对于一个document：

{
    "name": "jack",
    "age": 26,
    "email": "[e-mail]",
    "address": "guamazhou"
}

那么"jack 26 [e-mail] guamazhou",就会作为这个document的_all fieldd的值，同时进行分词后建立对应的倒排索引。
注意在生产环境中一般不会使用query string这种查询方式。