Question

我有6个简单的文件：

{"id":1,"sid":"adf6eb4f-35a0-4099-95d4-00ce3d984cf2","asid":"577ce6b0-b8b7-49af-8528-4e4797027a12","_tid":"21"}
{"id":1,"sid":"adf6eb4f-35a0-4099-95d4-00ce3d984cf2","asid":"577ce6b0-b8b7-49af-8528-4e4797027a12","_tid":"21"}
{"id":2,"sid":"abcdef","asid":"fedcba","_tid":"21"}
{"id":3,"sid":"ghijk","asid":"kjihg","_tid":"21"}
{"id":4,"sid":"lmnop","asid":"ponml","_tid":"21"}
{"id":5,"sid":"prstuv","asid":"vutsrp","_tid":"21"}

我使用以下命令在此数据集上运行value_count聚合：

curl -XGET 'http://poc02.transerainc.com:9200/test/csrs/_search' -d '{"size":0,"aggregations":{"SUMMARY_0_sid":{"value_count":{"field":"sid"}}}}'

我期待结果是6，但我得到14！

{"took":3,"timed_out":false,"shards":{"total":5,"successful":5,"failed":0},"hits":{"total":6,"maxscore":0.0,"hits":[]},"aggregations":{"SUMMARY_0_sid":{"value":14}}}

这似乎是一个明显的错误，但我在这里缺少什么？

Answer 1

您应该检查sid的弹性搜索mapping设置，sid是analyzed字段（默认情况下最有可能）？如果将其视为analyzed字段，则“adf6eb4f-35a0-4099-95d4-00ce3d984cf2”将分为5个不同的部分。所以总计数累计为5 + 5 + 1 + 1 + 1 + 1 = 14

elasticsearch返回字段上的value_count不正确

1 个答案: