elasticsearch - 如何在elasticsearch中进行多级子聚合？

Question

我有一个 USER 类型，它有 EVENT 类型的 child 。

事件可以有不同的字段。所以一个事件可能有 visitDate字段，而另一个事件可能是人口统计事件并具有 age field 。

我想做多级聚合，例如，我可以在其中查看每天的年龄分割。 IE:

1st July
  Age: 24 - 10 docs
  Age: 25 - 15 docs 
2nd July
  Age: 24 - 5 docs
  Age: 25 - 6 docs
etc

我面临的问题是，如果我进行子聚合，例如:

{
  "size": 2,
  "aggs": {
    "events": {
      "children": {
        "type" : "event"
      },
      "aggs": {
        "visitDate": {
          "terms":{
            "field":"visitDate",
            "size":0
          },
          "aggs":{
            "byAge":{
              "terms":{
                "field":"age",
                "size":0
              } 
            } 
          } 
        }
      }
    }
  }
}

ETC

二级聚合(按年龄)只能访问与 visitDate 上的聚合匹配的子文档，而不是任何其他属于同一父级的子级的子文档。

我怎样才能任意深度聚合，但是每次连续聚合都在查看那个桶中 child 的 parent ？

Answer 1

您可以使用嵌套聚合来实现这一点，我之前遇到过相同的情况，我使用以下查询来获得这样的结果(按语言聚合有声读物时间使用情况，这是 audio_book 中的嵌套子文档):

Elasticsearch 文档:

  {
    "_index": "dev_analytics",
    "_type": "UsageAnalytics",
    "_id": "AWLc_3OL-IIrUiI24XbD",
    "_score": 2.1704133,
    "_source": {
      "timestamp": 1523983693559,
      "audio_book": {
        "id": "0032423404234234234",
        "name": "Jag ger dig solen",
        "languages": [
          {
            "code": "sv",
            "type": "TEXT"
          }
        ],
      "usage": {
        "unitOfMeasure": "SEC",
        "totalUsage": 1200
      }
    }
  }

所需聚合:

"buckets": [
          {
            "key": "sv",
            "doc_count": 247,
            "usage": {
              "doc_count": 247,
              "total_usage": {
                "count": 247,
                "min": 1200,
                "max": 1200,
                "avg": 1200,
                "sum": 296400
              }
            }
          },
          {
            "key": "en",
            "doc_count": 47,
            "usage": {
              "doc_count": 47,
              "total_usage": {
                "count": 47,
                "min": 1200,
                "max": 1200,
                "avg": 1200,
                "sum": 56400
              }
            }
          },
          {
            "key": "de",
            "doc_count": 24,
            "usage": {
              "doc_count": 24,
              "total_usage": {
                "count": 24,
                "min": 1200,
                "max": 1200,
                "avg": 1200,
                "sum": 28800
              }
            }
          },
          {
            "key": "ar",
            "doc_count": 20,
            "usage": {
              "doc_count": 20,
              "total_usage": {
                "count": 20,
                "min": 1200,
                "max": 1200,
                "avg": 1200,
                "sum": 24000
              }
            }
          }
        ]

嵌套聚合查询:

GET dev_analytics/UsageAnalytics/_search
{
  "size": 0,
  "aggs": {
     "lang": {
       "nested": {
         "path": "title.languages"
       },
       "aggs": {
         "terms": {
           "terms": {
             "field": "title.languages.code"
           },
           "aggs": {
             "usage": {
               "reverse_nested": {},
               "aggs": {
                 "total_usage": {
                   "stats": {
                     "field": "usage.totalUsage"
                   }
                 }
               }
             }
           }
         }
       }
     }
   }
}