Elasticsearch无法匹配含RabbitMQ.Client.Impl的文档问题求助

我尝试在Elasticsearch的logs-2023-01索引中，搜索exception字段同时包含"semaphore"和"RabbitMQ.Client.Impl"的文档。示例异常内容如下：

System.ObjectDisposedException: The semaphore has been disposed.
   at System.Threading.SemaphoreSlim.Release(Int32 releaseCount)
   at RabbitMQ.Client.Impl.AsyncConsumerWorkService.WorkPool.HandleConcurrent(Work work, IModel model, SemaphoreSlim limiter)

当搜索"semaphore"时，可正常返回目标文档，请求及响应如下：

请求：

POST /logs-2023-01/_search?pretty=true
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "exception": "semaphore"
          }
        },
        {
          "range": {
            "logDate": {
              "gte": "now-43200m"
            }
          }
        }
      ]
    }
  },
  "size": 1000
}

响应：

{
  "took": 5,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 1,
    "max_score": 7.5582323,
    "hits": [
      {
        "_index": "logs-2023-01",
        "_type": "record",
        "_id": "q21yk4UBAdlSjmEEw5gy",
        "_score": 7.5582323,
        "_source": {
          "applicationName": "k8s-application",
          "logDate": "2023-01-08T22:13:59.873",
          "logLevel": "Error",
          "loggerName": "TaskScheduler.UnobservedTaskException.Logger",
          "machineName": "k8s-pod-6755d4997c-rztgl",
          "threadId": "2",
          "message": "An unobserved task exception occurred. The semaphore has been disposed.",
          "exception": """
System.ObjectDisposedException: The semaphore has been disposed.
   at System.Threading.SemaphoreSlim.Release(Int32 releaseCount)
   at RabbitMQ.Client.Impl.AsyncConsumerWorkService.WorkPool.HandleConcurrent(Work work, IModel model, SemaphoreSlim limiter)

""",
          "sortDate": "2023-01-08T22:13:59.000027026"
        }
      }
    ]
  }
}

但使用相同结构查询"RabbitMQ.Client.Impl"时，却无匹配结果，请求及响应如下：

请求：

POST /logs-2023-01/_search?pretty=true
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "exception": "RabbitMQ.Client.Impl"
          }
        },
        {
          "range": {
            "logDate": {
              "gte": "now-43200m"
            }
          }
        }
      ]
    }
  },
  "size": 1000
}

响应：

{
  "took": 8,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  }
}

匹配失败的核心原因是Elasticsearch的分词逻辑与match查询的行为不匹配：

1. 你的exception字段应为text类型，默认使用standard分词器。该分词器会将带点号的字符串（如RabbitMQ.Client.Impl）按.分割并转为小写，拆分为rabbitmq、client、impl三个独立的词。
2. 当你使用match查询"RabbitMQ.Client.Impl"时，查询字符串会被同样的分词器处理为三个词。match查询默认采用OR逻辑，但即便如此，若你需要的是匹配完整的短语"RabbitMQ.Client.Impl"，match查询无法保证词的连续性和顺序，因此无法命中目标文档——它只会匹配包含任意单个分词的文档，而非连续的短语。
3. 而搜索"semaphore"时，该词是单个独立词汇，分词后与索引中的词完全匹配，因此match查询能正常返回结果。

针对你的需求，可采用以下几种方案：

方案1：使用match_phrase查询短语 #

match_phrase会严格匹配分词后的词序列，要求词的顺序和连续性完全一致：

POST /logs-2023-01/_search?pretty=true
{
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "exception": "RabbitMQ.Client.Impl"
          }
        },
        {
          "range": {
            "logDate": {
              "gte": "now-43200m"
            }
          }
        }
      ]
    }
  },
  "size": 1000
}

方案2：使用wildcard查询（适合模糊匹配带点号的字符串） #

如果你需要模糊匹配包含该子串的文档，可使用通配符查询：

POST /logs-2023-01/_search?pretty=true
{
  "query": {
    "bool": {
      "must": [
        {
          "wildcard": {
            "exception": "*RabbitMQ.Client.Impl*"
          }
        },
        {
          "range": {
            "logDate": {
              "gte": "now-43200m"
            }
          }
        }
      ]
    }
  },
  "size": 1000
}

注意：wildcard查询性能较低，不建议在高频查询中使用。

方案3：为exception字段添加keyword子字段 #

如果需要频繁进行精确子串匹配，可修改索引mapping，为exception字段添加keyword子字段（需重新索引数据）：

PUT /logs-2023-01/_mapping
{
  "properties": {
    "exception": {
      "type": "text",
      "fields": {
        "keyword": {
          "type": "keyword",
          "ignore_above": 2048
        }
      }
    }
  }
}

之后使用wildcard查询该子字段，性能比text字段的wildcard更好：

POST /logs-2023-01/_search?pretty=true
{
  "query": {
    "bool": {
      "must": [
        {
          "wildcard": {
            "exception.keyword": "*RabbitMQ.Client.Impl*"
          }
        },
        {
          "range": {
            "logDate": {
              "gte": "now-43200m"
            }
          }
        }
      ]
    }
  },
  "size": 1000
}

内容的提问来源于stack exchange，提问作者im-devops