过滤聚合 returns 无结果

Question

我正在尝试在下面的示例中复制 filtered aggregation：在这里，我试图过滤与管道名称匹配的文档，并找到在这些管道中执行的最长持续时间。

{
    "_source" : {"excludes": ["stderr"]},
    "aggs" : {
        "max_duration_filtered" : {
            "filter" : {
                "term": {
                        "pipeline": "{name_of_pipeline}"
                }
            },
            "aggs" : {
                "max_duration" : {
                        "max" : {
                                "field" : "duration"
                        }
                }
            }
        }
    }
}

调用此 returns 以下输出连同 1 个命中（我也传入了 size=1）

{
  "took" : 5,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 63643,
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "{name-of-index}",
        "_type" : "raw_data",
        "_id" : "{an-id}",
        "_score" : 1.0,
        "_source" : {
          "duration" : 42.8,
          "pipeline" : "{a-different-pipeline}",
          "buildNumber" : {build-number-integer}
        }
      }
    ]
  },
  "aggregations" : {
    "max_duration_filtered" : {
      "doc_count" : 0,
      "max_duration" : {
        "value" : null
      }
    }
  }
}

我真的很想深入了解为什么最大持续时间值为空。看来我非常仔细地反映了文档中的内容。有什么我可以尝试解决这个问题的吗？谢谢！

Answer 1

以下查询将为您提供每个管道的最长持续时间。无需按特定管道过滤。

{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "pipeline.keyword": "some-pipeline"
          }
        }
      ]
    }
  },
  "aggs": {
    "pipelines": {
      "terms": {
        "field": "pipeline.keyword",
        "size": 100
      },
      "aggs": {
        "max_duration": {
          "max": {
            "field": "duration"
          }
        }
      }
    }
  }
}

过滤聚合 returns 无结果

Filtered Aggregation returns no results

python

elasticsearch

elasticsearch-aggregation