Elasticsearch查询以处理日志数据

Question

我在Elasticsearch中有一个电子商务网站的事件日志。 每个事件都是ES中的一条记录

{
    "_index": "event_log",
    "_type": "log_type",
    "_id": "3ud-kmoBazYRVz7KCgIy",
    "_score": 1,
    "_source": {
      "user_id": 123,
      "event": "click",
      "category": "abc",
      "product_id": 1112
    }
  },
  {
    "_index": "event_log",
    "_type": "log_type",
    "_id": "4Od-kmoBazYRVz7KCgLr",
    "_score": 1,
    "_source": {
      "user_id": 123,
      "event": "click",
      "category": "abc",
      "product_id": 1118
    }
  },
  {
    "_index": "event_log",
    "_type": "log_type",
    "_id": "4ud-kmoBazYRVz7KkwL2",
    "_score": 1,
    "_source": {
      "user_id": 123,
      "event": "cart",
      "category": "xyz",
      "product_id": 1
    }
  },
  {
    "_index": "event_log",
    "_type": "log_type",
    "_id": "2ud-kmoBazYRVz7KCALB",
    "_score": 1,
    "_source": {
      "user_id": 123,
      "event": "cart",
      "category": "xyz",
      "product_id": 11
    }
  },

我想要列出所有product_id分组的列表event，category，user。

预期输出：

{"click": {
   "abc": {
     "123": {
       "product_id": [1112, 1118]
      }
    }
   },
 "cart": {
   "xyz": {
     "123": {
       "product_id": [1, 11]
      }
    }
   }
  }   

我将在索引中拥有数百万条记录。查询所有记录并对其进行处理非常耗时。有没有办法在单个查询中产生输出？我确定不可能完全以给定的格式生成。靠近它非常有用。

Answer 1

嗨，这是我的建议（第一次尝试）

GET event_log/_search
{
  "size": 0,
  "aggs": {
    "event": {
      "terms": {
        "field": "event"
      },
      "aggs": {
        "category": {
          "terms": {
            "field": "category"
          },
          "aggs": {
            "product_id": {
              "terms": {
                "field": "product_id"
              }
            }
          }
        }
      }
    }
  }

}