`terms` 聚合的条件

Question

我想根据聚合数据在其他词过滤数据中添加条件。

目前，我有一个问题

GET sense/_search
{
  "size": 0,
  "aggs": {
    "dates": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "1d",
        "format": "yyyy-MM-dd",
        "offset": "+4h"
      },
      "aggs": {
        "unique_sessions": {
          "terms": {
            "field": "sessionId"
          }
        }
      }
    }
  }
}

哪returns这种数据

{
  "aggregations" : {
    "dates" : {
      "buckets" : [
        {
          "key_as_string" : "2019-03-31",
          "key" : 1554004800000,
          "doc_count" : 14,
          "unique_sessions" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "83e1c3a4-341c-4ac3-a81e-f00336ee1dfb",
                "doc_count" : 3
              },
              {
                "key" : "99c4d312-2477-4bf7-ad02-ef76f50443f9",
                "doc_count" : 3
              },
              {
                "key" : "425b840f-9604-4f1d-ab18-96a9a7ae44e0",
                "doc_count" : 1
              },
              {
                "key" : "580b1f6c-6256-4f38-9803-2cc79a0a63d7",
                "doc_count" : 2
              },
              {
                "key" : "8929d75d-153c-4b66-8dd7-2eacb7974b95",
                "doc_count" : 1
              },
              {
                "key" : "8da5d732-d1e7-4a63-8f02-2b84a8bdcb62",
                "doc_count" : 2
              }
            ]
          }
        },
        {
          "key_as_string" : "2019-04-01",
          "key" : 1554091200000,
          "doc_count" : 1,
          "unique_sessions" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "513d4532-304d-44c7-bdc7-398795800383",
                "doc_count" : 1
              },
              {
                "key" : "8da5d732-d1e7-4a63-8f02-2791poc34gq1",
                "doc_count" : 2
              }
            ]
          }
        }
      ]
    }
  }
}

所以我想检索唯一 sesssionId 的计数，其中 doc_count 等于 1。

这意味着我期望结果，其中带有键 "2019-03-31" 的日期直方图将显示 2（因为桶中名称为 unique_sessions 的聚合只有两个 doc_count 等于一个的会话）因此 "2019-04-01" 将显示 1 作为结果。

不知道如何实现这个聚合。

Answer 1

您需要对您拥有的术语聚合使用 Bucket Selector Aggregation。

下面是您的查询的显示方式：

示例查询

POST <your_index_name>/_search
{  
   "size":0,
   "aggs":{  
      "dates":{  
         "date_histogram":{  
            "field":"@timestamp",
            "interval":"1d",
            "format":"yyyy-MM-dd",
            "offset":"+4h"
         },
         "aggs":{  
            "unique_sessions":{  
               "terms":{  
                  "field":"sessionId"
               },
               "aggs":{  
                  "unique_buckets":{  
                     "bucket_selector":{  
                        "buckets_path":{  
                           "count":"_count"
                        },
                        "script":"params.count==1"
                     }
                  }
               }
            }
         }
      }
   }
}

请注意，如以下回复所述，在这种情况下，您最终会得到空桶。

响应示例

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 9,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "dates": {
      "buckets": [
        {
          "key_as_string": "2018-12-31",
          "key": 1546228800000,
          "doc_count": 3,
          "unique_sessions": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "83e1c3a4-3AFA1c-4ac3-a81e-f00336ee1dfb",
                "doc_count": 1
              }
            ]
          }
        },
        {
          "key_as_string": "2019-01-01",
          "key": 1546315200000,
          "doc_count": 0,
          "unique_sessions": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": []
          }
        },
        {
          "key_as_string": "2019-01-02",
          "key": 1546401600000,
          "doc_count": 3,
          "unique_sessions": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": []
          }
        },
        {
          "key_as_string": "2019-01-03",
          "key": 1546488000000,
          "doc_count": 3,
          "unique_sessions": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "83e1c3a4-3AFA1c-4ab3-a81e-f00336ee1dfb",
                "doc_count": 1
              }
            ]
          }
        }
      ]
    }
  }
}

在这种情况下，如果您希望过滤存储桶以仅显示与具有 count==1 的子存储桶相匹配的父存储桶，只需使用下面的查询，我在其中添加了另一个存储桶选择器子句.

仔细注意查询的结构。

优化查询解决方案：

POST <your_index_name>/_search
{  
   "size":0,
   "aggs":{  
      "dates":{  
         "date_histogram":{  
            "field":"@timestamp",
            "interval":"1d",
            "format":"yyyy-MM-dd",
            "offset":"+4h"
         },
         "aggs":{  
            "unique_sessions":{  
               "terms":{  
                  "field":"sessionId"
               },
               "aggs":{  
                  "unique_buckets":{  
                     "bucket_selector":{  
                        "buckets_path":{  
                           "count":"_count"
                        },
                        "script":"params.count==1"
                     }
                  }
               }
            },
            "terms_bucket_clause": {
              "bucket_selector": {
                "buckets_path": {
                  "count": "unique_sessions._bucket_count"
                },
                "script": "params.count>0"
              }
            }
         }
      }
   }
}

优化查询响应

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 9,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "dates": {
      "buckets": [
        {
          "key_as_string": "2018-12-31",
          "key": 1546228800000,
          "doc_count": 3,
          "unique_sessions": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "83e1c3a4-3AFA1c-4ac3-a81e-f00336ee1dfb",
                "doc_count": 1
              }
            ]
          }
        },
        {
          "key_as_string": "2019-01-03",
          "key": 1546488000000,
          "doc_count": 3,
          "unique_sessions": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "83e1c3a4-3AFA1c-4ab3-a81e-f00336ee1dfb",
                "doc_count": 1
              }
            ]
          }
        }
      ]
    }
  }
}

请注意这两个查询的结果差异。希望这对您有所帮助！

`terms` 聚合的条件

Condition on `terms` aggregation

elasticsearch

elasticsearch-dsl

elasticsearch-aggregation

示例查询

响应示例

优化查询解决方案：

优化查询响应