aggs弹性查询中的多个字段

Question

我的弹性映射为

"mappings": {
    "keywords": {
        "properties": {
            "Keyword": {
                "type": "text",
                "fields": {
                    "keyword": {
                        "type": "keyword",
                        "ignore_above": 256
                    }
                }
            },
            "KeywordType": {
                "type": "text",
                "fields": {
                    "keyword": {
                        "type": "keyword",
                        "ignore_above": 256
                    }
                }
            }
        }
    }
}

我试图检索两个字段关键字及其关键字类型。

{
 "query": {
    "bool": {
        "must": [{
            "match": {
                "Keyword": TEXT_REQ

            }
        }]
    }
},
"aggs": {
    "keywords": {
        "terms": {
            "field":"Keyword.keyword",
            "size": 500
        }
    }
}
}

它返回文本中存在的所有关键字。我也想同时使用关键字类型，我尝试过multiple value scores

{aggs:{
       "keywords":{"terms":{"field":"Keyword.keyword"}},
       "keywordtype":{"terms":{"field":"KeywordType.keyword"}}
       }}

但是我没有得到相应的关键字类型的关键字。我得到了总体关键字类型。

{... "aggregations":{"keywords":{... "buckets":[ {"key": "management"}]},
                     "keywordtype":{... "buckets":[{"key":"Tools"}, {"key":"technology"}]}

我需要输出

 bucket:[{"keyword":"management", keywordtype:"Tools"}]

如何修改弹性查询？

Answer 1

您可以使用以下任一查询：

解决方案1：使用复合聚合：

您可以使用下面的Composite Aggregation，因为您提到要将Keyword和KeywordType分组

聚合查询：

POST <your_index_name>/_search
{
    "size": 0,
    "query": {
      "bool": {
        "must": [
          {
            "match": {
              "Keyword": "TEXT_REQ"
            }
          }
        ]
      }
    }, 
    "aggs" : {
        "my_buckets": {
            "composite" : {
                "sources" : [
                    { "keyword": { "terms" : { "field": "Keyword.keyword" } } },
                    { "keywordType": { "terms" : { "field": "KeywordType.keyword" } } }
                ]
            }
        }
     }
}

示例响应：

{
  "took" : 40,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 4,
    "max_score" : 0.0,
    "hits" : [ ]
  },
  "aggregations" : {
    "my_buckets" : {
      "after_key" : {
        "keyword" : "TEXT_REQ",
        "keywordType" : "TEXT_REQ_Type3"
      },
      "buckets" : [                        <----- Required Results Start
        {
          "key" : {
            "keyword" : "TEXT_REQ",
            "keywordType" : "TEXT_REQ_Type1"
          },
          "doc_count" : 1
        },
        {
          "key" : {
            "keyword" : "TEXT_REQ",
            "keywordType" : "TEXT_REQ_Type2"
          },
          "doc_count" : 2
        },
        {
          "key" : {
            "keyword" : "TEXT_REQ",
            "keywordType" : "TEXT_REQ_Type3"
          },
          "doc_count" : 1
        }
      ]                                    <----- Required Results End
    }
  }
}

解决方案2：使用术语汇总

我使用Terms Aggregation构造了父子（父为Keyword，子为KeywordType），它位于下面的树结构中。

Bool Query
Terms Aggregation on Keyword.keyword
- Terms Aggregation on KeywordType.keyword

汇总查询：

POST <your_index_name>/_search
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "Keyword": "TEXT_REQ"
          }
        }
      ]
    }
  },
  "aggs": {
    "mykeywords": {
      "terms": {
        "field": "Keyword.keyword",
        "size": 10
      },
      "aggs": {
        "mytypes": {
          "terms": {
            "field": "KeywordType.keyword",
            "size": 10
          }
        }
      }
    }
  }
} 

示例响应：

{
  "took" : 97,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 4,
    "max_score" : 0.0,
    "hits" : [ ]
  },
  "aggregations" : {
    "mykeywords" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "TEXT_REQ",                    <----- Parent Value i.e Keyword
          "doc_count" : 4,
          "mytypes" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [                        <----- Children i.e. KeywordType
              {
                "key" : "TEXT_REQ_Type2",
                "doc_count" : 2
              },
              {
                "key" : "TEXT_REQ_Type1",
                "doc_count" : 1
              },
              {
                "key" : "TEXT_REQ_Type3",
                "doc_count" : 1
              }
            ]
          }
        }
      ]
    }
  }
}

让我知道这是否有帮助！