elasticsearch - 在Elasticsearch中添加子聚合

Question

我正在尝试从具有以下结构的Elasticsearch检索数据:

"hits":[
   { _index...
     _type....
     _score...
     "_source": {
                  "language": "english",
                  "timeDic": {
                               "date": "Friday",
                               "time": {
                                         "timeofday": "15:23"
                                        }
                              }
                 }
   }       
   { _index...
     _type....
     _score...
     "_source": {
                  "language": "spanish",
                  "timeDic": {
                               "date": "Friday",
                               "time": {
                                         "timeofday": "18:23"
                                        }
                              }
                 }
   }
   { _index...
     _type....
     _score...
     "_source": {
                  "language": "english",
                  "timeDic": {
                               "date": "Saturday",
                               "time": {
                                         "timeofday": "08:23"
                                        }
                              }
                 }
   }
  ...
 }
]

我要获取的字段是date和timeofday。

我尝试使用以下代码获取数据。

    'timeDic': {
       terms: {
             field: 'date.keyword',
             order: {
                  _count: "desc"
               }
             },
             aggs: {
                  'time': {
                        terms: {
                             field: "timeofday.keyword",
                              order: {
                                   _count: "desc"
                                   }
                          }
                  }
              }

问题是hour1的存储桶为空，它返回以下内容:

timeDic: {doc_count_error_upper_bound: 0, sum_other_doc_count: 0, 
…}
   buckets: [{key: "Friday", doc_count: 208,…}, {key: "Sunday", 
   doc_count: 207,…},…]
     0: {key: "Friday", doc_count: 208,…}
      doc_count: 208
      key: "Friday"
        time: {doc_count_error_upper_bound: 0, 
         sum_other_doc_count: 0, buckets: []}
            buckets: []
            doc_count_error_upper_bound: 0
            sum_other_doc_count: 0

我正在寻找的答案是这样的。

timeDic: {doc_count_error_upper_bound: 0, sum_other_doc_count: 0, 
…}
   buckets: [{key: "Friday", doc_count: 208,…}, {key: "Sunday", 
   doc_count: 207,…},…]
     0: {key: "Friday", doc_count: 208,…}
      doc_count: 208
      key: "Friday"
        time: {doc_count_error_upper_bound: 0, 
         sum_other_doc_count: 0, buckets: []}
            buckets: [key: "15:23", doc_count: whatever they are,…}]
                    doc_count: whatever they are
                    key: "15:23"
                    doc_count_error_upper_bound: 0
                    sum_other_doc_count: 0

当然我已经阅读了Elasticsearch文档和其他评论，但是到目前为止我还没有发现任何东西。

Answer 1

根据我们的讨论，我得出了以下信息，其中包含示例文档，聚合查询及其响应。

样本文件:

POST myindex/mydocs/1
{
  "timeDic": {
    "date": "Friday",
    "time": {
      "timeofday": "15:30"
    }
  }
}

POST myindex/mydocs/2
{
  "timeDic": {
    "date": "Friday",
    "time": {
      "timeofday": "15:30"
    }
  }
}

POST myindex/mydocs/3
{
  "timeDic": {
    "date": "Friday",
    "time": {
      "timeofday": "15:45"
    }
  }
}

POST myindex/mydocs/4
{
  "timeDic": {
    "date": "Monday",
    "time": {
      "timeofday": "15:30"
    }
  }
}

汇总查询:

在可用日期提供 times及其 count的解决方案。

POST myindex/_search
{
  "size": 0,
  "aggs":{
    "timeDic": {
      "terms": {
        "field": "timeDic.date.keyword",
        "min_doc_count": 1, 
        "size": 10
      },
      "aggs": {
        "theTimes": {
          "terms": {
            "field": "timeDic.time.timeofday.keyword",
            "min_doc_count": 1, 
            "size": 10
          }
        }
      }
    }
  }
}

该查询将返回该特定日期的时间列表。您应该恰好有七个主存储桶，每个存储桶代表一周中的几天，并带有当天时间的子存储桶列表。

它基本上是 Terms Aggregation以及另一个子集合，后者又是 Terms Aggregation

请注意，我是如何添加 "min_doc_count": 1的，该声明指出我只想返回具有 count > 0的存储桶。

另外，您可以根据需要更改大小值。

汇总结果:

{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 4,
    "max_score" : 0.0,
    "hits" : [ ]
  },
  "aggregations" : {
    "theDays" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "Friday",
          "doc_count" : 3,
          "theTimes" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "15:30",
                "doc_count" : 2
              },
              {
                "key" : "15:45",
                "doc_count" : 1
              }
            ]
          }
        },
        {
          "key" : "Monday",
          "doc_count" : 1,
          "theTimes" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "15:30",
                "doc_count" : 1
              }
            ]
          }
        }
      ]
    }
  }
}

让我知道这是否是您想要的。