Question

下面是我的弹性文件。

{
  "_index": "records",
  "_type": "_doc",
  "_id": "27",
  "_version": 1,
  "_score": null,
  "_source": {
    "dlvehicleclass": "dlVehicleClass",
    "challan_offences": [
      {
        "offence_name": "Valid Insurance",
        "amount": 100
      },
      {
        "offence_name": "Fail to produce certificate of Fitness",
        "amount": 4000
      },
      {
        "offence_name": "Fail to produce Driving Licence (No DL) ",
        "amount": 1200
      }
    ],
    "challan_status": [
      {
        "challan_status": "Cash",
      }
    ],
  }
}

我想以给定格式进行数据处理。如果challan_status是“现金”，那么

犯罪名称金额之和

调查期间出示的有效保险证明100

无法出示健身证书（无功能证书）或没有健身证书4000的铺垫

无法产生驾驶执照（无DL）或没有有效的DL 1200的驾驶

当我尝试获取数据时，我没有得到回应。

犯罪名称金额之和

在调查4300期间出示的有效保险证明

无法出示合格证书（无功能证书）或没有获得合格证书4300进行铺垫

未能出示驾驶执照（无DL）或没有有效DL 4300的驾驶

Answer 1

您需要将字段“ challan_offences”从对象类型更改为nested数据类型并使用nested aggregation。

对象类型被展平，即字段“ challan_offences”将存储为

{
     challan_offences.offence_name="<sometext>",
     challan_offences.amount=100,
     challan_offences.offence_name="<sometext>",
     challan_offences.amount=4000,
     challan_offences.offence_name="<sometext>",
     challan_offences.amount=1200
}

因此总和显示错误的值。通过更改为嵌套类型关系，将在offence_name中保留船舶，并保持金额

映射

PUT index70
{
  "mappings": {
    "properties": {
      "challan_offences":{
        "type": "nested",
        "properties": {
          "offence_name":{
            "type":"text",
            "fields":{
              "keyword":{
                "type":"keyword"
              }
            }
          },
          "amount":{
            "type":"integer"
          }
        }
      }
    }
  }
}

查询：

{
  "aggs": {
    "challan_offences": {
      "nested": {
        "path": "challan_offences"
      },
      "aggs": {
        "offence_name": {
          "terms": {
            "field": "challan_offences.offence_name.keyword"
          },
          "aggs": {
            "amount": {
              "sum": {
                "field": "challan_offences.amount"
              }
            }
          }
        }
      }
    }
  },
  "size": 0,
  "_source": {
    "excludes": []
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "query": {
    "bool": {
      "must": [],
      "should": [],
      "must_not": []
    }
  }
}

结果：

  "aggregations" : {
    "challan_offences" : {
      "doc_count" : 3,
      "offence_name" : {
        "doc_count_error_upper_bound" : 0,
        "sum_other_doc_count" : 0,
        "buckets" : [
          {
            "key" : "Fail to produce Driving Licence (No DL) ",
            "doc_count" : 1,
            "amount" : {
              "value" : 1200.0
            }
          },
          {
            "key" : "Fail to produce certificate of Fitness",
            "doc_count" : 1,
            "amount" : {
              "value" : 4000.0
            }
          },
          {
            "key" : "Valid Insurance",
            "doc_count" : 1,
            "amount" : {
              "value" : 100.0
            }
          }
        ]
      }
    }
  }

汇总汇总的Elasticsearch查询中的问题

1 个答案: