如何按字段类型对匹配的文档字段进行分组

Question

我使用术语聚合来计算字段值，但在聚合之前，我会根据结果进行筛选搜索。。最后，我需要id和聚合计数，例如如果异常id是1，并且匹配，那么我需要输出为

1->"key"："transfer"doc_count"：2

2->"key"："stock"doc_count"：4

我在下面突出显示了异常id，我希望它作为每个bucket的指针。

我如何在弹性搜索中做到这一点我已经附上了回复样本。

{
"took": 250,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": {
"value": 1,
"relation": "eq"
},
"max_score": 0.0,
"hits": [
{
"_index": "america",
"_type": "_doc",
"_id": "1",
"_score": 0.0,
"_source": {
"clusterId": "1",
"rank": 1,
"events": [
{
"eventId": "1",
"eventType": "Delayed",
"metaInfo": {
"batch_id": "batch_1"
},
"recommendationData": [
{
***"exceptionId": "1",***
"item": "Item1",
"location": "DC1",
"dueDate": "2019-01-10T05:30:00.000+0530",
"quantity": 100,
"metaInfo": {
"batch_id": "batch_1",
"dummy_id": "dummy_1"
},
"rank": 1,
"recommendations": [
{
"rank": 1,
"recommendationType": "transfer",
"customerName": "Walmart",
"stockTransfer": {
"primaryRecommendation": true,
"priority": 1,
"sourceLocation": "DC3",
"metaInfo": 40,
"shipDate": "2019-01-09T05:30:00.000+0530",
"arrivalDate": "2019-01-10T05:30:00.000+0530",
"transportMode": "Road",
"transferCost": 200.0,
"maxQtyAvailableForTransfer": 40,
"totalQtyAtSource": 40
},
"expedite": null
},
{
"rank": 1,
"recommendationType": "transfer",
"customerName": "Walmart",
"stockTransfer": {
"primaryRecommendation": true,
"priority": 2,
"sourceLocation": "DC2",
"transferQuantity": 60,
"shipDate": "2019-01-09T05:30:00.000+0530",
"arrivalDate": "2019-01-10T05:30:00.000+0530",
"transportMode": "Road",
"transferCost": 600.0,
"maxQtyAvailableForTransfer": 100,
"totalQtyAtSource": 100
},
"expedite": null
}
]
}
]
}
]
}
}
]
},
"aggregations": {
"recommendationTypes": {
"doc_count": 2,
"recommendationTypes": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "transfer",
"doc_count": 2
}
]
}
}
}
}

Answer 1

如果要对任何exceptionId或recommendationType进行聚合，这两种类型都在嵌套对象中，则需要使用嵌套聚合。

Ex。如果您有一个包含两个嵌套文档的文档，exceptionId分别为1和2。如果要在exceptionId为2的嵌套文档上进行聚合，即使在"查询"部分使用嵌套查询进行筛选，也需要使用嵌套聚合，因为即使嵌套对象匹配，也会返回整个文档，并且在聚合中必须特别提到要在特定嵌套对象上进行聚合。查询

{
"aggs": {
"recommendations": {
"nested": {
"path": "events.recommendationData"
},
"aggs": {
"exception": {
"filter": {
"terms": {
"events.recommendationData.exceptionId": [
"2"
]
}
},
"aggs": {
"exceptionIds": {
"terms": {
"field": "events.recommendationData.exceptionId.keyword",
"size": 10
},
"aggs": {
"recommendations": {
"nested": {
"path": "events.recommendationData.recommendations"
},
"aggs": {
"recommendationType": {
"terms": {
"field": "events.recommendationData.recommendations.recommendationType",
"size": 10
}
}
}
}
}
}
}
}
}
}
}
}

结果：

"aggregations" : {
"recommendations" : {
"doc_count" : 1,
"exception" : {
"doc_count" : 1,
"exceptionIds" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "2",
"doc_count" : 1,
"recommendations" : {
"doc_count" : 2,
"recommendationType" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "transfer",
"doc_count" : 2
}
]
}
}
}
]
}
}
}
}