I have an array of key value
pairs. Is it possible to exact match value of key
& then do a check on it's value
's range value?
Example: In below doc oracle_props
is an array with name, value pairs. I need to check if it has "oracle_cursors"
key and then check if it's value is less than 1000.
GET /eg/message/_percolate
{
"doc": {
"client": {
"name": "Athena",
"version": 1,
"db": {
"@type": "Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 64bit",
"oracle_props": [
{
"@name": "open_cursors",
"@value": 4000
},
{
"@name": "USER_ROLE_PRIVS_COUNT",
"@value": 1
},
{
"@name": "CREATE_PERMISSION",
"@value": "Y"
}
]
}
}
}
}
Below is my percolator.
I also need to check the following so that it gives back 3
as my result
- "client.name" must be "Athena"
- "client.db.@type" must be "Oracle" then only go ahead and check below points
- "client.db.oracle_props.@name" field is not found
- check if it has "oracle_cursors" key and then check if it's value is < 1000
1 & 2 are and operations and any of 3 or 4 satisfies it should result 3
. I need help with point 4, below is my query. Also please suggest if there is a better way.
PUT /eg/.percolator/3
{
"query": {
"filtered": {
"filter": {
"or": [
{
"missing": {
"field": "client.db.oracle_props.@name"
}
}
]
},
"query": {
"bool": {
"must": [
{
"match": {
"client.name": "Athena"
}
},
{
"match": {
"client.db.@type": "Oracle"
}
}
]
}
}
}
}
}
Update
Can I have something like below
{
"match": {
"client.db.oracle_props[name='open_cursors'].value": 4000
}
}
More tries
I followed elasticsearch nested query and changed the mapping to nestedtype by re-indexing. Can anyone find problem why am i getting nested: NullPointerException;
?
PUT /eg/.percolator/3
{
"nested" : {
"path" : "client.db.oracle_props",
"score_mode" : "avg",
"query" : {
"bool" : {
"must" : [
{
"match" : {"client.db.oracle_props.@name" : "open_cursors"}
},
{
"range" : {"client.db.oracle_props.@value" : {"lt" : 4000}}
}
]
}
}
}
}
mapping change
...
"properties": {
"@type": {
"type": "string"
},
"oracle_props": {
"type" : "nested",
"properties": {
"@name": {
"type": "string"
},
"@value": {
"type": "long"
}
}
}
}
...
See Question&Answers more detail:os