ElasticSearch 聚合过滤器（非嵌套）数组

Question

我有这样的映射：

PUT myindex1/_mapping
{
  "properties": {
    "program":{
        "properties":{
            "rounds" : {
                "properties" : {
                    "id" : {
                    "type" : "keyword"
                    },
                    "name" : {
                        "type" : "text",
                        "fields" : {
                            "keyword" : {
                            "type" : "keyword",
                            "ignore_above" : 256
                            }
                        }
                    }
                } 
            }
        }
    }
  }
}

还有我的示例文档：

POST myindex1/_doc
{
  "program": {
    "rounds":[
      {"id":"00000000-0000-0000-0000-000000000000", "name":"Test1"},
      {"id":"00000000-0000-0000-0000-000000000001", "name":"Fact2"}
    ]
  }
}

POST myindex1/_doc
{
  "program": {
    "rounds":[
      {"id":"00000000-0000-0000-0000-000000000002", "name":"Test3"},
      {"id":"00000000-0000-0000-0000-000000000003", "name":"Fact4"}
    ]
  }
}

POST myindex1/_doc
{
  "program": {
    "rounds":[
      {"id":"00000000-0000-0000-0000-000000000004", "name":"Test5"},
      {"id":"00000000-0000-0000-0000-000000000005", "name":"Fact6"}
    ]
  }
}

目的：仅获取被用户过滤为通配符的回合名称。聚合查询：

GET myindex1/_search
{
  "aggs": {
        "result": {
          "aggs": {
            "names": {
              "terms": {
                "field": "program.rounds.name.keyword",
                "size": 10000,
                "order": {
                  "_key": "asc"
                }
              }
            }
          },
          "filter": {
            "bool": {
              "must":[
                {
                  "wildcard": {
                    "program.rounds.name": "*test*"
                  }
                }
              ]
            }
          }
        }
    },
    "size": 0
}

这个集合returns所有6个名字，但我只需要Test1,Test3,Test5。还尝试了 include": "/tes.*/i" terms 的正则表达式模式，但忽略大小写不起作用。注意：我确定嵌套类型，因为我对 Id 和 Name 之间的关联不感兴趣（至少现在是这样）。弹性搜索版本：7.7.0

Answer 1

如果您只想根据名称字段上的条件聚合特定轮次，则需要设置 rounds nested，否则所有名称值最终都在同一字段中。

您的映射需要更改为：

PUT myindex1/
{
  "mappings": {
    "properties": {
      "program": {
        "properties": {
          "rounds": {
            "type": "nested",             <--- add this
            "properties": {
              "id": {
                "type": "keyword"
              },
              "name": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword",
                    "ignore_above": 256
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

然后您的查询需要更改为：

GET myindex1/_search
{
  "size": 0,
  "query": {
    "nested": {
      "path": "program.rounds",
      "query": {
        "bool": {
          "must": [
            {
              "wildcard": {
                "program.rounds.name": "*Test*"
              }
            }
          ]
        }
      }
    }
  },
  "aggs": {
    "rounds": {
      "nested": {
        "path": "program.rounds"
      },
      "aggs": {
        "name_filter": {
          "filter": {
            "wildcard": {
              "program.rounds.name": "*Test*"
            }
          },
          "aggs": {
            "names": {
              "terms": {
                "field": "program.rounds.name.keyword",
                "size": 10000,
                "order": {
                  "_key": "asc"
                }
              }
            }
          }
        }
      }
    }
  }
}

结果将是：

  "aggregations" : {
    "rounds" : {
      "doc_count" : 6,
      "name_filter" : {
        "doc_count" : 3,
        "names" : {
          "doc_count_error_upper_bound" : 0,
          "sum_other_doc_count" : 0,
          "buckets" : [
            {
              "key" : "Test1",
              "doc_count" : 1
            },
            {
              "key" : "Test3",
              "doc_count" : 1
            },
            {
              "key" : "Test5",
              "doc_count" : 1
            }
          ]
        }
      }
    }
  }

更新：

实际上，您可以通过以下查询在不引入嵌套类型的情况下实现您想要的。你很接近，但是 include 模式是错误的

GET myindex1/_search
{
  "aggs": {
    "result": {
      "aggs": {
        "names": {
          "terms": {
            "field": "program.rounds.name.keyword",
            "size": 10000,
            "include": "[Tt]est.*",
            "order": {
              "_key": "asc"
            }
          }
        }
      },
      "filter": {
        "bool": {
          "must": [
            {
              "wildcard": {
                "program.rounds.name": "*Test*"
              }
            }
          ]
        }
      }
    }
  },
  "size": 0
}

ElasticSearch 聚合过滤器（非嵌套）数组

ElasticSearch Aggregation Filter (not nested) Array

aggregation

elasticsearch