Question

我们的索引文档没有完全固定的架构，也就是说，并非每个文档都在每个文档中。有没有办法根据一组文档中的字段（即响应查询）创建存储桶，并计算包含这些字段的文档数量？例如，我刚刚编写的这些文档包含查询结果：

{"name":"Bob","field1":"value","field2":"value2","field3":"value3"}
{"name":"Sue","field2":"value4","field3":"value5"}
{"name":"Ali","field1":"value6","field2":"value7"}
{"name":"Joe","field3":"value8"}

这是我要提取的信息（不是格式）：

  name: 4
field1: 2
field2: 3
field3: 3

有没有办法可以聚合并计算得到这些结果？

Answer 1

是的，我认为你可以这样做：

GET /some_index/some_type/_search?search_type=count
{
  "aggs": {
    "name_bucket": {
      "filter" : { "exists" : { "field" : "name" } }
    },
    "field1_bucket": {
      "filter" : { "exists" : { "field" : "field1" } }
    },
    "field2_bucket": {
      "filter" : { "exists" : { "field" : "field2" } }
    },
    "field3_bucket": {
      "filter" : { "exists" : { "field" : "field3" } }
    }
  }
}

你得到这样的东西：

   "aggregations": {
      "field3_bucket": {
         "doc_count": 3
      },
      "field1_bucket": {
         "doc_count": 2
      },
      "field2_bucket": {
         "doc_count": 3
      },
      "name_bucket": {
         "doc_count": 4
      }
   }

使用Elasticsearch以返回文档中的字段进行存储

1 个答案: