我正在尝试过滤存储桶中的嵌套聚合。
对应:
{ "dev.directory.3" : { "mappings" : { "profile" : { "properties" : { "events" : { "type" : "nested", "properties" : { "id" : { "type" : "integer" }, "name" : { "type" : "string", "index" : "not_analyzed" }, } }, "title" : { "type" : "string" } } } } } }
索引数据:
"hits" : { "total" : 1, "max_score" : 1.0, "hits" : [ { "_index" : "dev.directory.3", "_type" : "profile", "_id" : "1", "_score" : 1.0, "_source" : { "title" : "Project manager", "events" : [ { "id" : 1, "name" : "Event A", }, { "id" : 2, "name" : "Event B", }, { "id" : 3, "name" : "Event C", }, { "id" : 4, "name" : "Event D", } ], } } ] }
我正在使用此查询和聚合定义
{ "query": { "nested": { "path": "events", "query": { "bool": { "filter": [{ "terms": { "events.id": [1, 2] } }] } }, "inner_hits": {} } }, "aggs": { "events.name12": { "filter": {}, "aggs": { "inner": { "nested": { "path": "events" }, "aggs": { "events.name": { "terms": { "field": "events.name" } }, "events.name_count": { "cardinality": { "field": "events.name" } } } } } } }, "size": 20, "_source": ["email", "company_name", "events"] }
我从聚合结果中得到的是:
"aggregations": { "events.name12": { "doc_count": 2, "filtered": { "doc_count": 4, "events.name": { "buckets": [ { "key": "Event A", "doc_count": 1 }, { "key": "Event B", "doc_count": 1 }, { "key": "Event C", "doc_count": 1 }, { "key": "Event D", "doc_count": 1 } ] }, "events.name_count": { "value": 4 } } }
我在筛选存储桶列表时遇到了麻烦,因为它们只能提供所提供的事件ID,因此结果应类似于:
"aggregations": { "events.name12": { "doc_count": 2, "filtered": { "doc_count": 2, "events.name": { "buckets": [ { "key": "Event A", "doc_count": 1 }, { "key": "Event B", "doc_count": 1 } ] }, "events.name_count": { "value": 2 } } }
您快到了,只需要events.id在聚合中添加过滤器即可,如下所示:
events.id
{ "query": { "nested": { "path": "events", "query": { "bool": { "filter": [ { "terms": { "events.id": [ 1, 2 ] } } ] } }, "inner_hits": {} } }, "aggs": { "events.name12": { "nested": { "path": "events" }, "aggs": { "inner": { "filter": { "terms": { "events.id": [ 1, 2 ] } }, "aggs": { "events.name": { "terms": { "field": "events.name" } }, "events.name_count": { "cardinality": { "field": "events.name" } } } } } } }, "size": 20, "_source": [ "email", "company_name", "events" ] }
原因是您的查询将正确选择具有指定事件ID的嵌套事件的所有文档,但是,汇总将对所有选定文档中的所有嵌套事件进行处理。因此,您还需要从聚合中也没有正确ID的那些文档中过滤掉所有嵌套事件。