elasticsearch - 在Elasticsearch中过滤每个组的最新文档

Question

假设在Elasticsearch中索引了以下文档:

{student: "Chloe", date: "2016-10-27", grade: "A"}
{student: "Oliver", date: "2016-10-27", grade: "F"}
{student: "Chloe", date: "2016-10-26", grade: "B"}
{student: "Chloe", date: "2016-10-25", grade: "F"}
{student: "Oliver", date: "2016-10-25", grade: "A"}

我可以使用热门汇总来获得最新成绩的学生列表:

{student: "Chloe", date: "2016-10-27", grade: "A"}
{student: "Oliver", date: "2016-10-27", grade: "F"}

但是，如何获得最新成绩为“F”的学生列表(在此特定示例中，只有名称为“Oliver”的学生)？例如，预期结果为:

{student: "Oliver", date: "2016-10-27", grade: "F"}

有任何想法吗？

Answer 1

您可以使用bucket selector aggregation(仅限仅ES 2.x )来实现。我基本上是将每个学生的最高日期与获得F成绩(filtering)的最高日期进行比较，并且仅保留两个日期相同的结果。您可以根据需要删除top hits aggregation，它只是用于获取学生失败的特定记录。

{
  "size": 0,
  "aggs": {
    "group_by_students": {
      "terms": {
        "field": "student"
      },
      "aggs": {
        "only_f_grade_bucket": {
          "filter": {
            "term": {
              "grade": "F"
            }
          },
          "aggs": {
            "latest_date": {
              "max": {
                "field": "date"
              }
            },
            "top_hit":{
              "top_hits": {
                "size": 1
              }
            }
          }
        },
        "max_date": {
          "max": {
            "field": "date"
          }
        },
        "latest_failure": {
          "bucket_selector": {
            "buckets_path": {
              "failed_date": "only_f_grade_bucket.latest_date",
              "max_date": "max_date"
            },
            "script": "failed_date == max_date"
          }
        }
      }
    }
  }
}