Elasticsearch过滤搜索

ES 6.x中，如果我们查询的时候不需要返回所有字段，可以添加"_source":[filedid,...]选择我们需要返回的数据。还可以"_source":{"exclude":[filedid,...]}来排除一些字段。

举个例子，ES中的数据如果是直接查询返回有好几十个字段，过滤出其中几个字段

POST ip/xxxx/_search
{
     
"_source": ["email","name","age"],
"query":{
     
	"bool":{
     
		must:[
		{
     
			"match":{
     
				"email":"[email protected]"
			}
		}
		]
	}
}
}

# 返回
{
     
"took": 98,
"timed_out": false,
"_shards": {
     
"total": 4,
"successful": 4,
"skipped": 0,
"failed": 0
},
"hits":{
     
"total":2,
"max_score": 26.820211,
"hits":[
{
     
"_index": "xxxx",
"_type": "test",
"_id": "id233312",
"_score": 26.820211,
"_source": {
     
"name": "ZAF",
"age": 19,
"email": "[email protected]"
}
},
{
     
"_index": "xxxx",
"_type": "test",
"_id": "id233312",
"_score": 26.820493,
"_source": {
     
"name": "ZAF",
"age": 19,
"email": "[email protected]"
}
},]
}

还有一个问题，不知道ES支持不支持将几个字段合并返回，例如两个字段address1和 address2，两个组合起来才是完整的详细地址，ES有没有查询语法能新建一个address：address1+address2这样返回，虽然后面直接用python处理了，这里留以后查一下文档吧。