elasticsearch - 如何使Elasticsearch聚合仅创建1个存储桶？

Question

我有一个Elasticsearch索引，其中包含一个称为“主机”的字段。我正在尝试向Elasticsearch发送查询以获取索引中host的所有唯一值的列表。目前，这与我所能接近的:

{
"size": 0,
"aggs": {
    "hosts": {
        "terms": {"field": "host"}
        }
    }
}

哪个返回:

"buckets": [
            {
                "key": "04",
                "doc_count": 201
            },
            {
                "key": "cyn",
                "doc_count": 201
            },
            {
                "key": "pc",
                "doc_count": 201
            }
        ]

但是，主机的实际名称是04-cyn-pc。我的理解是，它将它们分成关键字，所以我尝试这样的操作:

{
"properties": {
    "host": {
        "type": "text",

        "fields": {
            "raw": {
                "type": "text",
                "analyzer": "keyword",
                "fielddata": true
                }
            }
        }
    }
}

但是它返回非法的_argument_exception "reason": "Mapper for [host.raw] conflicts with existing mapping in other types:\n[mapper [host.raw] has different [index] values, mapper [host.raw] has different [analyzer]]"
如您所知，我是Elasticsearch的新手，任何帮助或指导都很棒，谢谢!

Answer 1

尝试以下方法:

{
"properties": {
    "host": {
        "type": "text",
        "fields": {
            "raw": {
                "type": "keyword"
                }
            }
        }
    }
}