Question

如何对字段进行存储，然后将不同字段的所有值聚合到数组中。这是示例列表。

{
  "product": "xyz",
  "action": "add",
  "user": "bob"
},
{
  "product": "xyz",
  "action": "update",
  "user": "bob"
},
{
  "product": "xyz",
  "action": "add",
  "user": "alice"
},
{
  "product": "xyz",
  "action": "add",
  "user": "eve"
},
{
  "product": "xyz",
  "action": "delete",
  "user": "eve"
}

预期输出：

{
    "buckets": [
        {
            "key": "add",
            "doc_count": 3,
            "user": ["bob", "alice", "eve"]
        },
        {
            "key": "update",
            "doc_count": 1,
            "user": ["bob"]
        },
        {
            "key": "delete",
            "doc_count": 1,
            "user": ["eve"]
        }
    ]
}

如何将用户值推送到每个存储桶中的数组？弹性聚合中是否有类似于mongodb $ push或$ addToFields的东西？感谢帮助。这是进行中的汇总。

{
    "size": 0,
    "aggs": {
        "product_filter": {
            "filter": {
                "term": {
                    "product": "xyz"
                }
            },
            "aggs": {
                "group_by_action": {
                    "terms": {
                        "field": "action",
                        "size":1000,
                        "order": {
                            "_count": "desc"
                        }
                    }
                }
            }
        }
    }
}

Answer 1

这会吗？我刚刚添加了另一个Terms Aggregation链，如下所述：

汇总查询：

POST <your_index_name>
{
    "size": 0,
    "aggs": {
        "product_filter": {
            "filter": {
                "term": {
                    "product": "xyz"
                }
            },
            "aggs": {
                "group_by_action": {
                    "terms": {
                        "field": "action",
                        "size":1000,
                        "order": {
                            "_count": "desc"
                        }
                    },
                    "aggs": {
                      "myUsers": {
                        "terms": {
                          "field": "user",
                          "size": 10
                        }
                      }
                    }
                }
            }
        }
    }
}

响应：

{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 5,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "product_filter" : {
      "doc_count" : 5,
      "group_by_action" : {
        "doc_count_error_upper_bound" : 0,
        "sum_other_doc_count" : 0,
        "buckets" : [
          {
            "key" : "add",
            "doc_count" : 3,
            "myUsers" : {
              "doc_count_error_upper_bound" : 0,
              "sum_other_doc_count" : 0,
              "buckets" : [
                {
                  "key" : "alice",
                  "doc_count" : 1
                },
                {
                  "key" : "bob",
                  "doc_count" : 1
                },
                {
                  "key" : "eve",
                  "doc_count" : 1
                }
              ]
            }
          },
          {
            "key" : "delete",
            "doc_count" : 1,
            "myUsers" : {
              "doc_count_error_upper_bound" : 0,
              "sum_other_doc_count" : 0,
              "buckets" : [
                {
                  "key" : "eve",
                  "doc_count" : 1
                }
              ]
            }
          },
          {
            "key" : "update",
            "doc_count" : 1,
            "myUsers" : {
              "doc_count_error_upper_bound" : 0,
              "sum_other_doc_count" : 0,
              "buckets" : [
                {
                  "key" : "bob",
                  "doc_count" : 1
                }
              ]
            }
          }
        ]
      }
    }
  }
}

我不确定是否可以像您提到的那样将它们放在一个列表中。

希望这会有所帮助！

Elasticsearch存储桶和添加到列表

1 个答案:

汇总查询：

响应：