elasticsearch - 如何在 bool 每次匹配中准确返回一个文档

Question

我的文档具有这样的(简化)结构:

{uuid: 1, timestamp: "2017-10-18T01:30:00.000Z", "key": "value"}
{uuid: 2, timestamp: "2017-10-18T01:30:00.000Z", "key": "value"}
{uuid: 1, timestamp: "2017-10-18T01:25:00.000Z", "key": "value"}
{uuid: 2, timestamp: "2017-10-18T01:25:00.000Z", "key": "value"}
{uuid: 1, timestamp: "2017-10-18T01:20:00.000Z", "key": "value"}
{uuid: 2, timestamp: "2017-10-18T01:20:00.000Z", "key": "value"}

现在，我正在尝试像这样(使用最新时间戳记)为每个 uuid匹配准确地获得一个文档:

query: {
    bool: {
        should: [{
            match: {
                uuid: 1
            }
        },
        {
            match: {
                uuid: 2
            }
        }]
    }
}

但是，以上查询返回两个 uuid的多个文档。如何修改查询以返回两个最新的文档，包括 uuid 1和 2，如下所示:

{uuid: 1, timestamp: "2017-10-18T01:30:00.000Z", "key": "value"}
{uuid: 2, timestamp: "2017-10-18T01:30:00.000Z", "key": "value"}

Answer 1

我建议结合使用terms聚合和top_hits子聚合，如下所示:

{
  "query": {
    "bool": {
      "should": [
        {
          "term": {
            "uuid.keyword": 1
          }
        },
        {
          "term": {
            "uuid.keyword": 2
          }
        }
      ]
    }
  },
  "aggs": {
    "uuids": {
      "terms": {
        "field": "uuid.keyword"
      },
      "aggs": {
        "latest": {
          "top_hits": {
            "size": 1,
            "sort": {
              "timestamp": "desc"
            }
          }
        }
      }
    }
  }
}