Question

1。我下面有一个弹性搜索架构。

{
  "mappings": {
    "properties": {
      "process_id": {
        "type": "keyword"
      },
      "user_info": {
        "type": "nested",
        "properties": {
          "first_name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "last_name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "place": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      }
    }
  }
}

2。我已将以下文档添加到索引中。

POST processes/_bulk 
  {"index":{"_id":1}}
{"process_id": "123", "user_info": [{"first_name": "A", "last_name": "B","place":"London"},{"first_name": "C", "last_name": "D","place":"Moscow"}]}
{"index":{"_id":2}}
{"process_id": "123", "user_info": [{"first_name": "C", "last_name": "B","Place":"Delhi"},{"first_name": "A", "last_name": "D","Place":"Bangalore"}]}

3。我想搜索process_id为123， first_name作为A和last_name作为B，并在user_info的Place上进行汇总。我正在尝试如下操作。

{   "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "process_id:123"
          }
        },
        {
          "nested": {
            "path": "user_info",
            "query": {
              "query_string": {
                "query": "user_info.first_name:A AND user_info.last_name:B"
              }
            }
          }
        }
      ]
    }   },   "aggs": {
    "user_info": {
      "nested": {
        "path": "user_info"
      },
      "aggs": {
        "user_info.place": {
          "terms": {
            "field": "user_info.place"
          }
        }
      }
    }   } }

结果正确返回第一个文档。但是，现场的汇总返回伦敦和莫斯科。但是，我希望将伦敦作为输出返回。我不确定如何进行此操作。我也尝试过嵌套过滤器搜索聚合，但是在同一方法上没有成功。

Answer 1

汇总适用于整个文档，而不仅限于nested types，因此您同时看到places。但是，对于您的情况，因为您想知道嵌套的文档匹配的内容，可以使用Inner hits

{
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "process_id:123"
          }
        },
        {
          "nested": {
            "path": "user_info",
            "query": {
              "query_string": {
                "query": "user_info.first_name:A AND user_info.last_name:B"
              }
            },
            "inner_hits": {}
          }
        }
      ]
    }
  }
}

以上查询应为您提供内部匹配，如下所示：

 "_source" : {
          "process_id" : "123",
          "user_info" : [
            {
              "first_name" : "A",
              "last_name" : "B",
              "place" : "London"
            },
            {
              "first_name" : "C",
              "last_name" : "D",
              "place" : "Moscow"
            }
          ]
        },
        "inner_hits" : {
          "user_info" : {
            "hits" : {
              "total" : {
                "value" : 1,
                "relation" : "eq"
              },
              "max_score" : 1.3862944,
              "hits" : [
                {
                  "_index" : "t1",
                  "_type" : "_doc",
                  "_id" : "1",
                  "_nested" : {
                    "field" : "user_info",
                    "offset" : 0
                  },
                  "_score" : 1.3862944,
                  "_source" : {
                    "first_name" : "A",
                    "last_name" : "B",
                    "place" : "London"
                  }
                }
              ]
            }
          }
        }

在嵌套字段上聚合

1 个答案: