我在elasticsearch中有以下一组嵌套子聚合(field2是field1的子聚合,field3是field2的子聚合)。 然而,事实证明,field3的术语聚合不会包含没有field3的文档。
我的理解是,除了field3的术语查询之外,我还必须使用Missing子聚合查询来存储它们。
但我不知道如何将其添加到下面的查询中以便同时进行操作。
{
"size": 0,
"aggregations": {
"f1": {
"terms": {
"field": "field1",
"size": 0,
"order": {
"_count": "asc"
},
"include": [
"123"
]
},
"aggregations": {
"field2": {
"terms": {
"field": "f2",
"size": 0,
"order": {
"_count": "asc"
},
"include": [
"tr"
]
},
"aggregations": {
"field3": {
"terms": {
"field": "f3",
"order": {
"_count": "asc"
},
"size": 0
},
"aggregations": {
"aggTopHits": {
"top_hits": {
"size": 1
}
}
}
}
}
}
}
}
}
}
答案 0 :(得分:3)
在2.1.2及更高版本中,您可以使用missing
parameter of the terms aggregation,它允许您为缺少该字段的文档指定默认值。 (仅供参考,missing
参数从2.0开始可用,但是there was a bug阻止它处理子聚合,这就是你在这里使用它的方法。)
...
"aggregations": {
"field3": {
"terms": {
"field": "f3",
"order": {
"_count": "asc"
},
"size": 0,
"missing": "n/a" <----- provide a default here
},
"aggregations": {
"aggTopHits": {
"top_hits": {
"size": 1
}
}
}
}
}
但是,如果您使用的是2.x之前的ES群集,则可以使用与field3
聚合深度相同的missing
aggregation来存储缺少“f3”的文档像这样:
...
"aggregations": {
"field3": {
"terms": {
"field": "f3",
"order": {
"_count": "asc"
},
"size": 0
},
"aggregations": {
"aggTopHits": {
"top_hits": {
"size": 1
}
}
}
},
"missing_field3": {
"missing" : {
"field": "f3"
},
"aggregations": {
"aggTopMissingHit": {
"top_hits": {
"size": 1
}
}
}
}
}