Elasticsearch aggregation doesn't work with nested-type fields

时间:2015-09-01 21:35:51

标签: elasticsearch

I can't make elasticsearch aggregation+filter to work with nested fields. The data schema (relevant part) is like this:

"mappings": {
  "rb": {
    "properties": {
      "project": {
        "type": "nested",
        "properties": {
          "age": {
            "type": "long"
          },
          "name": {
            "type": "string",
            "index": "not_analyzed"
          }
        }
      }    
    }
  }
}

Essentially "rb" object contains a nested field called "project" which contains two more fields - "name" and "age". Query I'm running:

"aggs": {
  "root": {
    "aggs": {
      "group": {
        "aggs": {
          "filtered": {
            "aggs": {
              "order": {
                "percentiles": {
                  "field": "project.age",
                  "percents": ["50"]
                }
              }
            },
            "filter": {
              "range": {
                "last_updated": {
                  "gte": "2015-01-01",
                  "lt": "2015-07-01"
                }
              }
            }
          }
        },
        "terms": {
          "field": "project.name",
          "min_doc_count": 5,
          "order": {
            "filtered>order.50": "asc"
          },
          "shard_size": 10,
          "size": 10
        }
      }
    },
    "nested": {
      "path": "project"
    }
  }
}

This query is supposed to produce top 10 projects (project.name field) which match the date filter, sorted by their median age, ignoring projects with less than 5 mentions in the database. Median should be calculated only for projects matching the filter (date range).

Despite having more than a hundred thousands objects in the database, this query produces empty list. No errors, just empty response. I've tried it both on ES 1.6 and ES 2.0-beta.

1 个答案:

答案 0 :(得分:7)

我已经重新组织了您的聚合查询,我可以得到一些结果。主要点是类型,因为您聚合了nested类型,我在filter字段上取出了last_updated聚合,并将其作为第一个聚合在层次结构中向上移动。然后是nested字段上的project聚合,最后是termspercentile

这似乎很有效。请试试。

{
  "size": 0,
  "aggs": {
    "filtered": {
      "filter": {
        "range": {
          "last_updated": {
            "gte": "2015-01-01",
            "lt": "2015-07-01"
          }
        }
      },
      "aggs": {
        "root": {
          "nested": {
            "path": "project"
          },
          "aggs": {
            "group": {
              "terms": {
                "field": "project.name",
                "min_doc_count": 5,
                "shard_size": 10,
                "order": {
                  "order.50": "asc"
                },
                "size": 10
              },
              "aggs": {
                "order": {
                  "percentiles": {
                    "field": "project.age",
                    "percents": [
                      "50"
                    ]
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}