elasticsearch - 子聚合或基数聚合中的桶选择器

Question

我有这个问题

GET /my_index3/_search 
{
"size": 0,
  "aggs": {
    "num1": {
      "terms": {
        "field": "num1.keyword",
        "order" : { "_count" : "desc" }
      },
      "aggs": {
        "count_of_distinct_suffix": {
          "cardinality" :{
             "field" : "suffix.keyword"
          },
          "aggs": {
            "filter_count": {
              "bucket_selector": {
                "buckets_path": {
                   "the_doc_count": "_count"
                },
                "script": "params.doc_count == 2"
              }
            }
          }
        }
      }
    }
  } 
}

输出:

          "key" : "1563866656878888",
          "doc_count" : 42,
          "count_of_distinct_suffix" : {
            "value" : 2
          }
        },
        {
          "key" : "1563866656871111",
          "doc_count" : 40,
          "count_of_distinct_suffix" : {
            "value" : 2
          }
        },
        {
          "key" : "1563867854325555",
          "doc_count" : 36,
          "count_of_distinct_suffix" : {
            "value" : 1
          }
        },
        {
          "key" : "1563867854323333",
          "doc_count" : 12,
          "count_of_distinct_suffix" : {
            "value" : 1
          }
        },

我只想查看具有 "count_of_distinct_suffix": { "value": 2 }

的结果

我正在考虑桶选择器聚合，但不可能将其添加到基数聚合中...

         "aggs": {
        "my_filter": {
           "bucket_selector": {
              "buckets_path": {
                 "the_doc_count": "_count"
              },
              "script": "params.doc_count == 2"
           }
        }
     }

它给我以下错误:[cardinality] 类型的聚合器 [count_of_distinct_suffix] 无法接受子聚合

你们有解决办法吗？

非常感谢您提前提供的任何帮助!!

Answer 1

您不必将 bucket_selector 聚合添加为 cardinality 聚合的子聚合。相反，您应该将其平行添加，如下所示:

{
  "size": 0,
  "aggs": {
    "num1": {
      "terms": {
        "field": "num1.keyword",
        "order": {
          "_count": "desc"
        }
      },
      "aggs": {
        "count_of_distinct_suffix": {
          "cardinality": {
            "field": "suffix.keyword"
          }
        },
        "my_filter": {
          "bucket_selector": {
            "buckets_path": {
              "the_doc_count": "count_of_distinct_suffix"
            },
            "script": "params.the_doc_count == 2"
          }
        }
      }
    }
  }
}