如何基于弹性的其他存储桶的结果创建第三个存储块?

时间:2018-10-26 15:14:09

标签: elasticsearch aggregation bucket elasticsearch-aggregation

嘿Elasticsearch专业人士

我是这个领域的新手,所以我真的不知道该如何处理... 我在Elastic中有以下语句。

{"statement": {"id": "1a", "type": "cook", "actor": "user1", "timestamp":  "2016-11-29T10:14:19.180600+00:00"}},
{"statement": {"id": "1b", "type": "cook", "actor": "user1", "timestamp": "2016-11-29T15:03:59.907900+00:00"}},
{"statement": {"id":"1c", "type": "cook", "actor": "user2", "timestamp": "2016-11-29T15:21:48.873300+00:00"}},
{"statement": {"context": "1a", "type": "sleep", "actor": "user1", "timestamp": "2016-11-29T14:50:29.088900+00:00"}},
{"statement": {"context": "1b", "type": "sleep", "actor": "user1", "timestamp": "2016-11-29T15:06:38.894700+00:00"}},
{"statement": {"context":"1c", "type": "sleep", "actor": "user2", "timestamp": "2016-11-29T15:23:12.020700+00:00"}}

然后我创建2个按类型分组的存储桶...

{   
"size": 0,  
 "query": {
    "bool": {
       "should" : [
        { "term" : { "statement.type" : "cook" } },
        { "term" : { "statement.type" : "sleep" } }
      ]
    }   
  },
   "aggs": {
    "cook_": {
        "filter" : { 
            "term" : { 
              "statement.type" : "cook" 
            }
        },
        "aggs": {
          "user":{
            "terms" : { "field" : "statement.actor" },
             "aggs": {
                "object":{"terms" : { "field" : "statement.id" }
              }
            }
          }
        }
      },
      "sleep_": {
        "filter" : {
           "bool" : {
              "should" : [
                 { "term" : {"statement.type" : "sleep"}}
              ]
           }
        },
        "aggs": {
          "user":{
            "terms" : {
              "field" : "statement.actor" 
            },
             "aggs": {
                "object":{"terms" : { "field" : "statement.context" }
              }
            }
        }
      }
    }   
  } 
}

这是响应[数字为假]:

{
  "took": 290,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 52368,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "cook_": {
      "doc_count": 14263,
      "user": {
        "doc_count_error_upper_bound": 3,
        "sum_other_doc_count": 1822,
        "buckets": [
          {  
            "key": "user1",
            "doc_count": 329,
            "object": {
              "doc_count_error_upper_bound": 5,
              "sum_other_doc_count": 466,
              "buckets": [
                {
                  "key": "1a",
                  "doc_count": 12
                },
                {
                  "key": "1b",
                  "doc_count": 12
                }
              ]
            }
          },
            {  
            "key": "user2",
            "doc_count": 5329,
            "object": {
              "doc_count_error_upper_bound": 5,
              "sum_other_doc_count": 4626,
              "buckets": [
                {
                  "key": "1c",
                  "doc_count": 12
                }
              ]
            }
          }
        ]
      }
    },
     "sleep_": {
      "doc_count": 14163,
      "user": {
        "doc_count_error_upper_bound": 3,
        "sum_other_doc_count": 1822,
        "buckets": [
          {  
            "key": "user1",
            "doc_count": 39,
            "object": {
              "doc_count_error_upper_bound": 5,
              "sum_other_doc_count": 466,
              "buckets": [
                {
                  "key": "1a",
                  "doc_count": 12
                },
                {
                  "key": "1b",
                  "doc_count": 12
                }
              ]
            }
          },
            {  
            "key": "user2",
            "doc_count": 5329,
            "object": {
              "doc_count_error_upper_bound": 5,
              "sum_other_doc_count": 466,
              "buckets": [
                {
                  "key": "1c",
                  "doc_count": 12
                }
              ]
            }
          }
        ]
      }
    }
  }
}

现在我想要一个3个清单,其中应该比较存储桶... “ bucket1.id == bucket2.context”。 我的第3个存储区应该只具有带有statement.context的结果,其中也有一个statement.id。  有人可以帮忙吗?

将我从bucket1的每个条目给我给bucket2中的对应子对象

0 个答案:

没有答案