Question

我有一个存储在Elasticsearch 5.6索引中的警报记录。执行_search?q=*后，我得到的数据如下所示：

  "hits": [ 
   {
      "_index": "alerts",
      "_type": "alert-mapping",
      "_id": "AWG0lW0jxQ7bOrwfOzFI",
      "_score": 1,
      "_source": {
        "events": [
          {
             "name": "walking",
          }
        ],
        "categoryID": "easy",
        "comments": "this is a comment",
        "active": true
      }
    },
    {
      "_index": "alerts",
      "_type": "alert-mapping",
      "_id": "AWds3wd43980wfOzFI",
      "_score": 1,
      "_source": {
        "events": [
          {
             "name": "running",
          }
        ],
        "categoryID": "difficult",
        "comments": "this is another comment",
        "active": false
     }
   }]

根据数据规范，events数组只有一个值。这可能会在将来更新，但我现在可以根据这个假设进行操作。我要做的是创建一个查询，该查询将获得具有相应events.name的所有唯一categoryID值。

我有一个我认为可行的示例查询，但它会返回所有唯一的events.name值以及所有唯一的categoryID值。我当前的查询看起来像这样

GET alerts/_search
{
 "size":0,
 "aggs":{
    "alerts":{ 
        "terms":{ 
           "field":"events.name",
           "size":1 
         }
     },
     "categories":{
        "terms":{
           "field":"categoryID"
        }
     }
  }
}

这将返回看起来像这样的东西

"aggregations": {
"alerts": {
  "doc_count_error_upper_bound": 0,
  "sum_other_doc_count": 0,
  "buckets": [
    {
      "key": "running",
      "doc_count": 225
    },
    {
      "key": "walking",
      "doc_count": 219
    }
  ]
},
"categroies": {
  "doc_count_error_upper_bound": 0,
  "sum_other_doc_count": 0,
  "buckets": [
    {
      "key": "easy",
      "doc_count": 363
    },
    {
      "key": "difficult",
      "doc_count": 352
    }
  ]
}

}

我真正想要的是在返回的结果中将events.name和categoryID组合在一起的内容，因此我得到了events.name及其对应的categoryID。可能看起来像这样的东西

"aggregations": {
"alerts": {
  "doc_count_error_upper_bound": 0,
  "sum_other_doc_count": 0,
  "buckets": [
    {
      "key": "running",
      "categories": "difficult",
      "doc_count": 225
    },
    {
      "key": "walking",
      "categories": "easy",
      "doc_count": 219
    }
  ]
}

Answer 1

你可以将这一个嵌套在另一个中：

{
    "size": 0,
    "aggs": {
        "alerts": {
            "terms": {
                "field": "events.name",
                "size": 1
            },
            "aggs": {
                "categories": {
                    "terms": {
                        "field": "categoryID"
                    }
                }
            }
        }
    }
}

它不是您想要的结构，但它会为您提供嵌套的每个事件名称的所有唯一类别ID。我想不出一种方法可以达到你想要的输出效果。

Answer 2

如果您可以将“events”字段的映射更改为嵌套类型，那么您可以使用反向嵌套聚合来接近您想要的内容。

POST /alerts/_search
{
 "query":{
    "match_all": {}
 },
 "aggs":{
    "events_name": {
        "nested": {
            "path": "events"
        },
        "aggs":{
            "events":{
                "terms": {
                    "field": "events.name"
                },
                "aggs":{
                    "category_ids":{
                        "reverse_nested":{},
                        "aggs":{
                            "cat_ids_per_event":{
                                "terms": {
                                    "field": "categoryID"
                                }
                            }
                        }
                    }
                }
            }
        }
    }
 }
}

通过虚拟文档

获取此信息

"aggregations": {
    "events_name": {
        "doc_count": 9,
        "events": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
                {
                    "key": "walking",
                    "doc_count": 5,
                    "category_ids": {
                        "doc_count": 5,
                        "cat_ids_per_event": {
                            "doc_count_error_upper_bound": 0,
                            "sum_other_doc_count": 0,
                            "buckets": [
                                {
                                    "key": "easy",
                                    "doc_count": 5
                                }
                            ]
                        }
                    }
                },
                {
                    "key": "running",
                    "doc_count": 4,
                    "category_ids": {
                        "doc_count": 4,
                        "cat_ids_per_event": {
                            "doc_count_error_upper_bound": 0,
                            "sum_other_doc_count": 0,
                            "buckets": [
                                {
                                    "key": "difficult",
                                    "doc_count": 4
                                }
                            ]
                        }
                    }
                }
            ]
        }
    }
}

查询以重新定义elasticsearch中的唯一字段集

2 个答案: