ElasticSearch聚合组按顺序按子术语字段文档计数

Question

我的映射模型:

//TypeLog: Error, Info, Warn

{
   "onef-sora": {
      "mappings": {
         "Log": {
            "properties": {
               "application": {
                  "type": "string",
                  "index": "not_analyzed"
               }
               "typeLog": {
                  "type": "string"
               }
            }
         }
      }
   }
}

我查询:

{
  "size": 0,
  "aggs": {
    "application": {
      "terms": {
        "field": "application",
        "order" : { "_count" : "desc"},
        "size": 5
      },
      "aggs": {
        "typelogs": {
          "terms": {
            "field": "typeLog",
            "order" : { "_term" : "asc"}
          }
        }
      }
    }
  }
}

我想获得错误最多的前5个应用程序，但术语聚合顺序支持三个键:_count， _term， _key。我如何在查询中按typeLog doc_count排序。谢谢! !

Result I want:

 {
   "took": 3,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 10000,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "application": {
         "doc_count_error_upper_bound": 0,
         "sum_other_doc_count": 5000,
         "buckets": [
            {
               "key": "OneF0",
               "doc_count": 1000,
               "typelogs": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                     {
                        "key": "error",
                        "doc_count": 334
                     },
                     {
                        "key": "info",
                        "doc_count": 333
                     },
                     {
                        "key": "warn",
                        "doc_count": 333
                     }
                  ]
               }
            },
            {
               "key": "OneF1",
               "doc_count": 1000,
               "typelogs": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                     {
                        "key": "error",
                        "doc_count": 333
                     },
                     {
                        "key": "info",
                        "doc_count": 334
                     },
                     {
                        "key": "warn",
                        "doc_count": 333
                     }
                  ]
               }
            },
            {
               "key": "OneF2",
               "doc_count": 1000,
               "typelogs": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                     {
                        "key": "error",
                        "doc_count": 332
                     },
                     {
                        "key": "info",
                        "doc_count": 333
                     },
                     {
                        "key": "warn",
                        "doc_count": 334
                     }
                  ]
               }
            }
         ]
      }
   }
}

Answer 1

当您想要获得错误最多的前5个应用程序时，您可以筛选，只在查询中保留错误日志(您可以使用过滤器)。然后你只需要按降序计数

排序子项聚合

{
  "size": 0,
  "query": {
    "term": {
      "typeLog": "Error"
    }
  },
  "aggs": {
    "application": {
      "terms": {
        "field": "application",
        "order": {
          "_count": "desc"
        },
        "size": 5
      },
      "aggs": {
        "typelogs": {
          "terms": {
            "field": "typeLog",
            "order": {
              "_count": "desc"
            }
          }
        }
      }
    }
  }
}

要保留所有类型日志，您可能需要以另一种方式执行查询

{
  "size": 0,
  "aggs": {
    "typelogs": {
      "terms": {
        "field": "typeLog",
        "order": {
          "_count": "asc"
        }
      },
      "aggs": {
        "application": {
          "terms": {
            "field": "application",
            "order": {
              "_count": "desc"
            },
            "size": 5
          }
        }
      }
    }
  }
}

您将有3个第一级桶，按日志类型排列的前5个应用程序