Question

我有两个查询，它们在执行GET操作时会提取结果。第一个查询是-

{
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "*",
            "analyze_wildcard": true
          }
        },
        {
          "range": {
            "database-status.meta.current-time": {
              "lte": "now-91d/d"
            }
          }
        }
      ],
      "must_not": []
    }
  },
  "size": 0,
  "_source": {
    "excludes": []
  },
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "database-status.meta.current-time",
        "interval": "1h",
        "time_zone": "CST6CDT",
        "min_doc_count": 1
      },
      "aggs": {
        "3": {
          "terms": {
            "field": "database-status.name.keyword",
            "size": 500,
            "order": {
              "1": "desc"
            }
          },
          "aggs": {
            "1": {
              "sum": {
                "field": "database-status.status-properties.rate-properties.cache-properties.compressed-tree-cache-hit-rate.value",
                "script": "_value/60"
              }
            }
          }
        }
      }
    }
  }
}

，第二个查询是-

{
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "*",
            "analyze_wildcard": true
          }
        },
        {
          "range": {
            "database-status.meta.current-time": {
              "lte": "now-91d/d"
            }
          }
        }
      ],
      "must_not": []
    }
  },
  "size": 0,
  "_source": {
    "excludes": []
  },
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "database-status.meta.current-time",
        "interval": "1h",
        "time_zone": "CST6CDT",
        "min_doc_count": 1
      },
      "aggs": {
        "3": {
          "terms": {
            "field": "database-status.name.keyword",
            "size": 500,
            "order": {
              "1": "desc"
            }
          },
          "aggs": {
            "1": {
              "sum": {
                "field": "database-status.status-properties.rate-properties.cache-properties.compressed-tree-cache-miss-rate.value",
                "script": "_value/60"
              }
            }
          }
        }
      }
    }
  }
}

如何将两个查询合并为一个查询，并在相同的结果集中获得两个结果？基于此，我将尝试将该方法与其他查询一起复制，甚至尝试将3个或更多查询合并为1个。

Answer 1

有两种方法可以做到这一点：

使用multi search（msearch）将允许您向包含两个查询的ES运行一个请求。 msearch的响应将分别包含两个查询响应，然后您可以选择如何组合答案。
将查询合并成一个布尔值：

所以可以说你有： Q1->布尔->必须->内部-Q-1 和Q2-> bool-> must-> inner-q-2

然后，您可以将它们与应该： Q3->布尔->应该-> [内部q-1，内部q-2]，其中minimum_should_match等于1（非常重要！）

Answer 2

我利用了嵌套聚合。这是组合的代码-

{
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "*",
            "analyze_wildcard": true
          }
        },
        {
          "range": {
            "server-status.meta.current-time": {
              "lte": "now-91d/d"
            }
          }
        }
      ],
      "must_not": []
    }
  },
  "size": 0,
  "_source": {
    "excludes": []
  },
  "aggs": {
    "time-interval": {
      "date_histogram": {
        "field": "server-status.meta.current-time",
        "interval": "1h",
        "time_zone": "CST6CDT",
        "min_doc_count": 1
      },
      "aggs": {
        "http-server": {
          "terms": {
            "field": "server-status.type.keyword",
            "include": "http-server",
            "size": 500,
            "order": {
              "1": "desc"
            }
          },
          "aggs": {
            "1": {
              "sum": {
                "field": "server-status.status-properties.expanded-tree-cache-hit-rate.value",
                "script": "_value/60"
              }
            },
            "2": {
              "sum": {
                "field": "server-status.status-properties.expanded-tree-cache-miss-rate.value",
                "script": "_value/60"
              }
            },
            "3": {
              "terms": {
                "field": "server-status.name.keyword",
                "size": 500,
                "order": {
                  "1": "desc"
                }
              },
              "aggs": {
                "1": {
                  "sum": {
                    "field": "server-status.status-properties.expanded-tree-cache-hit-rate.value",
                    "script": "_value/60"
                  }
                },
                "2": {
                  "sum": {
                    "field": "server-status.status-properties.expanded-tree-cache-miss-rate.value",
                    "script": "_value/60"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

将两个弹性查询合并为1。如何？

2 个答案: