elasticsearch - 获取所有拥有更多 'N'子女的 parent

Question

我已经搜索了答案，但不幸的是找不到它。
我有一个包含用户类型的索引:

    users: {
    properties: {

        loginKey: {
            type: string
        }

        timeZone: {
            type: long
        }
        maxEmailsPerWeek: {
            type: long
        }

        joinDate: {
            format: dateOptionalTime
            type: date
        }
        preferredEntityId: {
            type: long
        }
        partition: {
            type: long
        }
        postalCode: {
            type: string
        }
        nickName: {
            type: string
        }
        announcements: {
            type: long
        }

        gender: {
            type: string
        }

        birthDate: {
            format: dateOptionalTime
            type: date
        }
        firstName: {
            type: string
        }
        emailTestId: {
            type: long
        }
        emailStateDate: {
            format: dateOptionalTime
            type: date
        }
        lastName: {
            type: string
        }
        emailAddress: {
            type: string
        }
...
    }
}

并具有用户的 Activity 类型:

    activity: {
    _routing: {
        required: true
    }
    properties: {
        eventTimestamp: {
            format: dateOptionalTime
            type: date
        }
        userAgent: {
            type: string
        }
        recordType: {
            type: string
        }
        universalTrackingParams: {
            properties: {
                MODULE_ID: {
                    type: string
                }
                TRACKING_CODE: { // this is a unique user identifier
                    index: not_analyzed
                    omit_norms: true
                    index_options: docs
                    type: string
                }
                SENDING_DOMAIN_PARAM: {
                    index: not_analyzed
                    omit_norms: true
                    index_options: docs
                    type: string
                }
                PRODUCT_ID: {
                    type: string
                }
                TEST_ID: {
                    type: string
                }
                MAILING_ID: {
                    type: string
                }
                NEWS_LETTER_ID: {
                    type: string
                }
                LINK_POSITION: {
                    type: integer
                }
                DECORATION_TIMESTAMP: {
                    type: string
                }
                SITE_ID: {
                    type: string
                }
                TEMPLATE_VERSION: {
                    type: string
                }
                ORIGINAL_LINK: {
                    index: not_analyzed
                    omit_norms: true
                    index_options: docs
                    type: string
                }
            }
        }
        ip: {
            index: not_analyzed
            omit_norms: true
            index_options: docs
            type: string
        }
    }
    _parent: {
        type: users
    }
}

我想做的是搜索所有拥有更多 N子代的 parent ，换句话说，我要获取在给定的时间段内( N)有 Activity (所有用户的 eventTimestamp次)的所有用户记录。

有人可以建议我可以阅读的资源还是可以完成该任务的查询

更新
因此，这就是我要解决的问题(使用下面由Sloan Ahrens创建的索引和类型):

{
  "min_score": 2,
  "query": {
    "top_children": {
      "type": "order",
      "score": "sum",
      "query": {
        "constant_score": {
          "query": {
            "match_all": {}
          }
        }
      }
    }
  }
}

这将使我获得至少3个订单的所有客户(感谢imotov)

Answer 1

好吧，由于它需要两个查询，因此它并不是一个完全令人满意的解决方案，但是我认为您可以使用构面来获得想要的东西。

进行一些简化(并使用this blog post中的模式/数据，我将首先创建一个具有父/子关系的简单索引:

curl -XPUT "http://localhost:9200/orders" -d'
{
    "mappings": { 
        "customer": {},
        "order" : {
            "_parent" : {
                "type" : "customer"
            }
        }
    }
}'

然后添加一些数据:

curl -XPOST "http://localhost:9200/orders/_bulk" -d'
{ "index" : { "_type" : "customer", "_id" : "john" } }
{ "name" : "John Doe" }
{ "index" : { "_type" : "order", "_parent" : "john" } }
{ "date" : "2013-10-15T12:00:00" }
{ "index" : { "_type" : "order", "_parent" : "john" } }
{ "date" : "2013-11-15T12:00:00" }
{ "index" : { "_type" : "order", "_parent" : "john" } }
{ "date" : "2013-12-01T12:00:00" }
{ "index" : { "_type" : "customer", "_id" : "jane" } }
{ "name" : "Jane Doe" }
{ "index" : { "_type" : "order", "_parent" : "jane" } }
{ "date" : "2013-11-20T12:00:00" }
{ "index" : { "_type" : "customer", "_id" : "bob" } }
{ "name" : "Bob Doe" }
{ "index" : { "_type" : "order", "_parent" : "bob" } }
{ "date" : "2013-09-20T12:00:00" }
'

然后我可以在 order字段中刻面 "_parent"，过滤要在 date上刻面的文档:

curl -XPOST "http://localhost:9200/orders/order/_search " -d'
{
    "size": 0, 
    "facets": {
       "customers": {
          "terms": {
              "field": "_parent"
          },
          "facet_filter": {
              "range": {
                    "date": {
                        "from": "2013-11-01T00:00:00"
                    }
                }
          }
       }
    }
}'

这给了我以下回应:

{
   "took": 3,
   "timed_out": false,
   "_shards": {
      "total": 1,
      "successful": 1,
      "failed": 0
   },
   "hits": {
      "total": 5,
      "max_score": 1,
      "hits": []
   },
   "facets": {
      "customers": {
         "_type": "terms",
         "missing": 0,
         "total": 3,
         "other": 0,
         "terms": [
            {
               "term": "customer#john",
               "count": 2
            },
            {
               "term": "customer#jane",
               "count": 1
            }
         ]
      }
   }
}

然后，我可以使用返回的ID通过第二个查询来检索 customer:

curl -XPOST "http://localhost:9200/orders/_search" -d'
{
   "query": {
      "ids": {
         "type": "customer",
         "values": [
            "john",
            "jane"
         ]
      }
   }
}'

您必须在最后两个步骤之间添加自己的逻辑，以便根据结果计数来确定要检索的客户，但是您也许可以使此方法在您的上下文中起作用。

这是一个可以运行的示例: http://sense.qbox.io/gist/9ebde72ccffa0dce654383ad4fb0a8451b74a9f7