将聚合限制为值列表

时间:2015-07-14 19:47:29

标签: elasticsearch

我可以限制聚合以仅返回特定的值列表吗?我有这样的事情:

.ui-accordion h3:before

但是,让我说我知道我想要的省份列表({'province1','province2','province3'})。是否可以限制退回的省份列表而不影响我的查询结果?

我想得到:

{ "aggs" : {
        "province" : {
            "terms" : {
              "field" : "province"
            }
        }
    },
    "query": {
        "bool": {
         //my query..

1 个答案:

答案 0 :(得分:4)

当然,只需使用term filters

这是一个例子。假设我已经访问了一堆不同的IP地址的统计数据,但我只想获得其中两个的文档计数,我可以这样做:

POST /test_index/_search?search_type=count
{
   "aggregations": {
      "ip": {
         "terms": {
            "field": "ip",
            "size": 10,
            "include": [
               "146.233.189.126",
               "193.33.153.89"
            ]
         }
      }
   }
}

并取回类似的内容:

{
   "took": 4,
   "timed_out": false,
   "_shards": {
      "total": 1,
      "successful": 1,
      "failed": 0
   },
   "hits": {
      "total": 7,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "ip": {
         "doc_count_error_upper_bound": 0,
         "sum_other_doc_count": 0,
         "buckets": [
            {
               "key": "146.233.189.126",
               "doc_count": 3
            },
            {
               "key": "193.33.153.89",
               "doc_count": 3
            }
         ]
      }
   }
}

以下是我用来玩它的一些代码:

http://sense.qbox.io/gist/68697646ef7afc9f0375995b6f84181a7ac4cba9

所以你的例子可能如下:

{
   "aggs": {
      "province": {
         "terms": {
            "field": "province",
            "include": [
               "province1",
               "province2",
               "province3"
            ]
         }
      }
   }
}