elasticsearch - 聚合 Elasticsearch 5

Question

在我的 Elasticsearch 中，索引具有以下条目类型。

{
  "_index": "employees",
  "_type": "employee",
  "_id": "10000",
  "_score": 1.3640093,
  "_source": {
    "itms": {
      "depc": [
        "IT",
        "MGT",
        "FIN"
      ],
      "dep": [
        {
          "depn": "Information Technology",
          "depc": "IT"
        },
        {
          "depn": "Management",
          "depc": "MGT"
        },
        {
          "depn": "Finance",
          "depc": "FIN"
        },
        {
          "depn": "Finance",
          "depc": "FIN"
        }
      ]
    }
  }
}

现在，我试图获取唯一的部门列表，包括部门代码(depc)和部门名称(depn)。

我正在尝试跟踪，但是没有得到预期的结果。

{
  "size": 0,
  "query": {},
  "aggs": {
    "departments": {
      "terms": {
        "field": "itms.dep.depc",
        "size": 10000,
        "order": {
          "_term": "asc"
        }
      },
      "aggs": {
        "department": {
          "terms": {
            "field": "itms.dep.depn",
            "size": 10
          }
        }
      }
    }
  }
}

任何建议表示赞赏。

谢谢

Answer 1

从您的agg查询中，看来itms.dep的映射类型是object而不是nested

Lucene has no concept of inner objects, so Elasticsearch flattens object hierarchies into a simple list of field names and values.

因此，您的文档已在内部转换为:

{
  "depc" :        ["IT","MGT","FIN"],
  "dep.depc" : [ "IT","MGT","FIN"],
  "dep.depn" :  [ "Information Technology", "Management", "Finance" ]
}

也就是说，您失去了 depc和 depn之间的关联

要解决此问题:

您需要将对象类型更改为嵌套

使用nested aggregation

现有的agg查询的结构对我来说似乎很好，但是您必须在映射更新后将其转换为嵌套聚合