如何在elasticsearch中删除类似的聚合桶

时间:2018-11-16 13:20:44

标签: elasticsearch

在以下聚合中,我想提取从nginx日志中索引的前10个唯一的URLs。我不确定汇总的结果。如何达到以下条件:

  • 收起request_path字段
  • 返回唯一地址
  • 删除类似的地址,例如/rest/v3/users/rest/v3/users/uuid,并在结果中返回父资源

查询:

GET _search
{
  "query": {
    "bool": {
      "must": {
        "match_phrase": {
          "request_path": "rest/v3"
        }
      }
    }
  },
  "aggs": {
    "top_hits": {
      "terms": {
        "field": "request_path.keyword",
        "size": 100000,
        "include": {
          "partition": 1,
          "num_partitions": 100
        }
      }
    }
  },
  "size": 20
}

预期结果:

[
  {
     "request_path": "/rest/v3/users",
     "count": 100
  },
  {
     "request_path": "/rest/v3/archives",
     "count": 20
  },
  {
     "request_path": "/rest/v3/payments",
     "count": 85
  }
  ...
]

0 个答案:

没有答案