Elasticsearch:Query部分影响嵌套字段上日期直方图的聚合结果

时间:2017-12-10 17:33:05

标签: elasticsearch elasticsearch-5

我有一个关于组合嵌套日期字段,date_histogram聚合和范围查询的问题。

我的整个查询如下:

{
    "query": {
        "nested": {
            "path": "transactions",
            "query": {
                "range": {
                    "transactions.date": {
                        "gte": "2013",
                        "lte": "2014",
                        "format": "yyyy"
                    }
                }
            }
        }
    },
    "aggs" : {
        "transactions": {
            "nested": {
                "path": "transactions"
            },
            "aggs": {
                "count_per_year": {
                    "date_histogram": {
                        "field": "transactions.date",
                        "interval": "year"
                    }
                }   
            }
        }
    }
}

其中给出了以下响应(仅显示聚合):

"aggregations": {
    "transactions": {
        "doc_count": 23302,
        "count_per_year": {
            "buckets": [
                {
                    "key_as_string": "2013-01-01T00:00:00.000Z",
                    "key": 1356998400000,
                    "doc_count": 181
                },
                {
                    "key_as_string": "2014-01-01T00:00:00.000Z",
                    "key": 1388534400000,
                    "doc_count": 8363
                },
                {
                    "key_as_string": "2015-01-01T00:00:00.000Z",
                    "key": 1420070400000,
                    "doc_count": 9621
                },
                {
                    "key_as_string": "2016-01-01T00:00:00.000Z",
                    "key": 1451606400000,
                    "doc_count": 5137
                }
            ]
        }
    }
}

如您所见,我仍然可以获得超出指定范围的日期值。更奇怪的是,如果我删除查询部分,我会收到以下响应:

"aggregations": {
    "transactions": {
        "doc_count": 65485,
        "count_per_year": {
            "buckets": [
                {
                    "key_as_string": "2013-01-01T00:00:00.000Z",
                    "key": 1356998400000,
                    "doc_count": 181
                },
                {
                    "key_as_string": "2014-01-01T00:00:00.000Z",
                    "key": 1388534400000,
                    "doc_count": 23009
                },
                {
                    "key_as_string": "2015-01-01T00:00:00.000Z",
                    "key": 1420070400000,
                    "doc_count": 27017
                },
                {
                    "key_as_string": "2016-01-01T00:00:00.000Z",
                    "key": 1451606400000,
                    "doc_count": 15278
                }
            ]
        }
    }
}

正如您所看到的,所有存储桶的doc_count(除了与范围对应的存储区)都增加了,这意味着某些值被过滤掉但不是全部。我已经检查了映射,transactions.date的类型为" date",这也可以通过date_histogram聚合能够将所有事务放入存储桶这一事实得到证实。知道我可能做错了吗?

我目前正在运行Elasticsearch 5.6.3。

1 个答案:

答案 0 :(得分:0)

我也面临同样的问题,我使用的解决方案是使用另一个过滤器aggs根据日期缩小文档范围。 以下查询可以解决您的问题:

{
    "query": {
        "nested": {
            "path": "transactions",
            "query": {
                "range": {
                    "transactions.date": {
                        "gte": "2013",
                        "lte": "2014",
                        "format": "yyyy"
                    }
                }
            }
        }
    },
    "aggs": {
        "transactions": {
            "nested": {
                "path": "transactions"
            },
            "aggs": {
                "filtering_date_range": {
                    "filter": {
                        "range": {
                            "transactions.date": {
                                "gte": "2013",
                                "lte": "2014",
                                "format": "yyyy"
                            }
                        }
                    }
                },
                "aggs": {
                    "count_per_year": {
                        "date_histogram": {
                            "field": "transactions.date",
                            "interval": "year"
                        }
                    }
                }
            }
        }
    }
}