elasticsearch - 在Elasticsearch上的单个查询中进行多重聚合

Question

我在log索引中有Elasticsearch数据。

`"hits": [
  {
    "_index": "event_log",
    "_type": "log_type",
    "_id": "2-d-kmoBazYRVz7KCQIj",
    "_score": 1,
    "_source": {
      "user_id": 123,
      "event": "click",
      "category": "abc",
      "product_id": 1112,
      "bkt": "A"
    }
  },
  {
    "_index": "event_log",
    "_type": "log_type",
    "_id": "3ed-kmoBazYRVz7KCQLX",
    "_score": 1,
    "_source": {
      "user_id": 456,
      "event": "click",
      "category": "abc",
      "product_id": 112,
      "bkt": "A"
    }
  },
  {
    "_index": "event_log",
    "_type": "log_type",
    "_id": "3ud-kmoBazYRVz7KCgIy",
    "_score": 1,
    "_source": {
      "user_id": 1234,
      "event": "click",
      "category": "abc",
      "product_id": 1112,
      "bkt": "B"
    }
  },
  {
    "_index": "event_log",
    "_type": "log_type",
    "_id": "4Od-kmoBazYRVz7KCgLr",
    "_score": 1,
    "_source": {
      "user_id": 4567,
      "event": "click",
      "category": "xyz",
      "product_id": 1118,
      "bkt": "B"
    }
  },
  {
    "_index": "event_log",
    "_type": "log_type",
    "_id": "4ud-kmoBazYRVz7KkwL2",
    "_score": 1,
    "_source": {
      "user_id": 123,
      "event": "cart",
      "category": "xyz",
      "product_id": 1,
      "bkt": "A"
    }
  },
  {
    "_index": "event_log",
    "_type": "log_type",
    "_id": "2ud-kmoBazYRVz7KCALB",
    "_score": 1,
    "_source": {
      "user_id": 123,
      "event": "cart",
      "category": "xyz",
      "product_id": 11,
      "bkt": "A"
    }
  },
  {
    "_index": "event_log",
    "_type": "log_type",
    "_id": "3-d-kmoBazYRVz7KCgKP",
    "_score": 1,
    "_source": {
      "user_id": 4567,
      "event": "click",
      "category": "abc",
      "product_id": 111,
      "bkt": "B"
    }
  },
  {
    "_index": "event_log",
    "_type": "log_type",
    "_id": "3Od-kmoBazYRVz7KCQJ8",
    "_score": 1,
    "_source": {
      "user_id": 456,
      "event": "click",
      "category": "abc",
      "product_id": 111,
      "bkt": "A"
    }
  },
  {
    "_index": "event_log",
    "_type": "log_type",
    "_id": "4ed-kmoBazYRVz7KCwJH",
    "_score": 1,
    "_source": {
      "user_id": 4567,
      "event": "click",
      "category": "xyz",
      "product_id": 1128,
      "bkt": "B"
    }
  }
]}

我想通过 aggregation， category， bkt获取 event。以及我想通过 user_id， category聚合 bkt。我对此有两个单独的查询

由 category， bkt和 event聚合的记录计数。

GET event_log/_search
{"size" : 0,
    "aggs": {
            "category_id": {
              "terms": { "field": "category.keyword" },
              "aggs": {
                "ab_bucket": {
                "terms": { "field": "bkt.keyword" },
                  "aggs": {
                    "event_type": {
                      "terms": { "field": "event.keyword" }
                   }
                  }
                }
              }
            }
          }
    }

结果是

"aggregations": {
"category_id": {
  "doc_count_error_upper_bound": 0,
  "sum_other_doc_count": 0,
  "buckets": [
    {
      "key": "abc",
      "doc_count": 5,
      "ab_bucket": {
        "doc_count_error_upper_bound": 0,
        "sum_other_doc_count": 0,
        "buckets": [
          {
            "key": "A",
            "doc_count": 3,
            "event_type": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 0,
              "buckets": [
                {
                  "key": "click",
                  "doc_count": 3
                }
              ]
            }
          },
          {
            "key": "B",
            "doc_count": 2,
            "event_type": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 0,
              "buckets": [
                {
                  "key": "click",
                  "doc_count": 2
                }
              ]
            }
          }
        ]
      }
    },

用户按 category和 bkt聚合。

GET event_log/_search
{"size" : 0,
"aggs": {
    "category_id": {
      "terms": { "field": "category.keyword" },
      "aggs": {
        "ab_bucket": {
        "terms": { "field": "bkt.keyword" },
          "aggs": {
            "total_uniq_users" : {
              "cardinality": {
                  "field" : "user_id"
              }
            }
          }
        }
      }
    }
  }
}

结果是

"aggregations": {
    "category_id": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "abc",
          "doc_count": 5,
          "ab_bucket": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "A",
                "doc_count": 3,
                "total_uniq_users": {
                  "value": 2
                }
              },
              {
                "key": "B",
                "doc_count": 2,
                "total_uniq_users": {
                  "value": 2
                }
              }
            ]
          }
        },

有没有一种方法可以合并两个查询并获得单个结果

Answer 1

是的，您可以这样做:

GET event_log/_search
{
  "size": 0,
  "aggs": {
    "category_id": {
      "terms": {
        "field": "category.keyword"
      },
      "aggs": {
        "ab_bucket": {
          "terms": {
            "field": "bkt.keyword"
          },
          "aggs": {
            "total_uniq_users": {
              "cardinality": {
                "field": "user_id"
              }
            },
            "event_type": {
              "terms": {
                "field": "event.keyword"
              }
            }
          }
        }
      }
    }
  }
}