elasticsearch - 在Elasticsearch中从字段中获取唯一值

Question

我有这个文件结构:

[
{
   "uuid":1,
   "data":{....},
   "date":"2020-10-10T23:00:00"
},
{
   "uuid":1,
   "data":{....},
   "date":"2020-10-10T23:00:00"
},
{
   "uuid":1,
   "data":{....},
   "date":"2020-10-10T23:00:00"
},
{
   "uuid":2,
   "data":{....},
   "date":"2020-10-10T23:00:00"
},
{
   "uuid":2,
   "data":{....},
   "date":"2020-10-10T23:00:00"
}
]

我如何编写一个返回uuid的查询。对于以上示例，我想要此结果:

[1, 2]

Answer 1

基于uuid字段的聚合:
一个工作示例:
映射

PUT my_index
{
  "mappings": {
    "properties": {
      "uuid": {
        "type": "keyword"
      },
      "date": {
        "type": "date"
      }
    }
  }
}

插入一些文档:

POST my_index/_doc/1
{
   "uuid":1,
   "date":"2020-10-10T23:00:00"
}
POST my_index/_doc/2
{
   "uuid":1,
   "date":"2020-10-10T23:00:00"
}
POST my_index/_doc/3
{
   "uuid":2,
   "date":"2020-10-10T23:00:00"
}
POST my_index/_doc/4
{
   "uuid":2,
   "date":"2020-10-10T23:00:00"
}

搜索查询:

GET my_index/_search
{
  "size": 0, 
  "aggs": {
    "uuids": {
      "terms": {
        "field": "uuid",
        "size": 10
      }
    }
  }
}

结果

"aggregations" : {
    "uuids" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "1",
          "doc_count" : 2
        },
        {
          "key" : "2",
          "doc_count" : 2
        }
      ]
    }
  }

key内的 buckets字段是 uuid值。