Elasticsearch Terms Aggregation - 用于对象的动态键

Question

文档结构

Doc_1 {
"title":"hello",
"myObject":{
 "key1":"value1",
 "key2":"value2"
 }
}
Doc_2 {
"title":"hello world",
"myObject":{
 "key2":"value4",
 "key3":"value3"
 }
}
Doc_3 {
"title":"hello world2",
"myObject":{
 "key1":"value1",
 "key3":"value3"
 }
}

信息：myObject 包含动态键值对。

Objective：我的objective是写聚合查询return唯一的所有动态键值对的个数。

尝试与解释：我可以通过这种方式轻松获取已知键的结果。

       {
        "size":0,
        "query":{
               "match":{"title":"hello"}
                },
        "aggs":{
               "key1Agg":{
                    "terms":{"field":"myObject.key1.keyword"}
                },
               "key2Agg":{
                    "terms":{"field":"myObject.key2.keyword"}
                },
               "key3Agg":{
                    "terms":{"field":"myObject.key3.keyword"}
               }
              }
          }

这是上述硬编码嵌套键聚合的典型结果。

{
...
"aggregations": {
    "key1Agg": {
        ...        
        "buckets": [
            {
                "key": "value1",
                "doc_count": 2
            }

        ]
    },
    "key2Agg": {
        ...
        "buckets": [
            {
                "key": "value2",
                "doc_count": 1
            },
            {
                "key": "value4",
                "doc_count": 1
            }

        ]
    },
    "key3Agg": {
       ...
        "buckets": [
            {
                "key": "value3",
                "doc_count": 2
            }

        ]
    }
}

}

现在我想要的是 return 所有动态键值对的计数，即不在聚合查询中放置任何硬核键名。

我正在使用 ES 6.3，在此先感谢！！

Answer 1

根据您提供的信息，myObject 似乎属于 object datatype and not nested datatype。

好吧，没有简单的方法可以不修改您拥有的数据，您可以做的可能是最简单的解决方案是包含一个额外的字段，比如我们将其称为 myObject_list属于 keyword 类型，其中文档如下所示：

示例文档：

POST test_index/_doc/1
{
 "title":"hello",
  "myObject":{
   "key1":"value1",
   "key2":"value2"
  },
  "myObject_list": ["key1_value1", "key2_value2"]     <--- Note this
}

POST test_index/_doc/2
{
 "title":"hello world",
  "myObject":{
   "key2":"value4",
   "key3":"value3"
  },
  "myObject_list": ["key2_value4", "key3_value3"]     <--- Note this
}

POST test_index/_doc/3
{
 "title":"hello world2",
  "myObject":{
   "key1":"value1",
   "key3":"value3"
  },
  "myObject_list": ["key1_value1", "key3_value3"]     <--- Note this
}

您可以进行如下简单的查询：

请求查询：

POST test_index/_search
{
  "size": 0,
  "aggs": {
    "key_value_aggregation": {
      "terms": {
        "field": "myObject_list",              <--- Make sure this is of keyword type
        "size": 10
      }
    }
  }
}

请注意，我在这里使用了 Terms Aggregation。

回复：

{
  "took" : 406,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 3,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "key_value_aggregation" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "key1_value1",
          "doc_count" : 2
        },
        {
          "key" : "key3_value3",
          "doc_count" : 2
        },
        {
          "key" : "key2_value2",
          "doc_count" : 1
        },
        {
          "key" : "key2_value4",
          "doc_count" : 1
        }
      ]
    }
  }
}

希望对您有所帮助！

Elasticsearch Terms Aggregation - 用于对象的动态键

Elasticsearch Terms Aggregation - for dynamic keys of an object

aggregation

elasticsearch

elasticsearch-6

示例文档：

请求查询：

回复：