Question

这是我的查询结果

{
  "took": 3,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 502,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "HIGH_RISK_USERS": {
      "doc_count": 1004,
      "USERS_COUNT": {
        "doc_count_error_upper_bound": 5,
        "sum_other_doc_count": 437,
        "buckets": [
          {
            "key": "49",
            "doc_count": 502,
            "NAME": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 0,
              "buckets": []
            }
          },
          {
            "key": "02122219455@53.205.223.157",
            "doc_count": 44,
            "NAME": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 0,
              "buckets": [
                {
                  "key": "caller",
                  "doc_count": 42
                },
                {
                  "key": "CallFrom",
                  "doc_count": 2
                }
              ]
            }
          },
          {
            "key": "+02129916178@53.205.223.157",
            "doc_count": 2,
            "NAME": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 0,
              "buckets": [
                {
                  "key": "caller",
                  "doc_count": 2
                }
              ]
            }
          }
        ]
      }
    }
  }
}

这是我的查询

    {
      "size": 0,
      "query": {
        "bool": {
          "filter": [
            {
              "nested": {
                "path": "x_nova_extensions.entities",
                "query": {
                  "bool": {
                    "filter": [
                      {
                        "match": {
                          "x_nova_extensions.entities.text": "49"
                        }
                      },
                      {
                        "terms": {
                          "x_nova_extensions.entities.type": [
                            "sourceCountryCode",
                            "CallerIPCountryCode",
                            "CallerIPCountryName",
                            "CallerIPCountryCode",
                            "CallerPhoneCountryName"
                          ]
                        }
                      }
                    ]
                  }
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "HIGH_RISK_USERS": {
          "nested": {
            "path": "x_nova_extensions.entities"
          },
          "aggs": {
            "USERS_COUNT": {
              "terms": {
                "field": "x_nova_extensions.entities.text",
                "size": 10,
                "order": {
                  "_count": "desc"
                }
              },
              "aggs": {
                "NAME": {
                  "terms": {
                    "field": "x_nova_extensions.entities.type",
                    "include": [
                      "caller",
                      "callee",
                      "CallFrom",
                      "CallTo"
                    ]
                  }
                }
              }
            }
          }
        }
      }
    }

我希望我的查询只返回 bucket []。size＆gt; 0

我在互联网上搜索，但找不到任何特定的关键字或其他内容。即使我不确定Elasticsearch是否支持这一点。我想确保Elasticsearch支持这个

是否有任何关键字或我该如何处理？

由于

Answer 1

我认为您正在寻找的是Aggregation Pipeline

通过这种方式，您可以达到存储分区的大小并相应地过滤结果。

"min_bucket_selector": {
      "bucket_selector": {
        "buckets_path": {
          "nameCount": "NAME._bucket_count" 
        },
        "script": {
          "source": "params.nameCount != 0"
        }
      }
    }
  }
}

但是请注意elasticsearch版本。该版本的应用方式可能因版本而异。

Elasticsearch中的桶大小过滤器

1 个答案: