elasticsearch - 使用ElasticSearch聚合获取完整文档

Question

我有一个类似的索引:

[
    {
        "Name": "Alex",
        "LastName": "Ich",
        "Department": 2
    },
    {
        "Name": "Charlie",
        "LastName": "Sheen",
        "Department": 3
    },
    {
        "Name": "Peter",
        "LastName": "Petrelli",
        "Department": 5
    },
    {
        "Name": "Alan",
        "LastName": "Harper",
        "Department": 6
    },
    {
        "Name": "Ann",
        "LastName": "Bottle",
        "Department": 3
    },
]

而且我想用不同的 Department获得结果，我不在乎顺序，每个 Department仅1个结果。我尝试使用聚合，但是我只能设法获得与doc_count相关联的其他 Deppartments。他们查询我尝试过的东西是这样的:

{
  "aggs": {
    "deppartments": {
      "terms": {
        "field": "Department"
      }
    }
  },"size": 0
}

它返回:

"buckets": [
    {
        "key": 2,
        "doc_count": 1
    },
    {
        "key": 3,
        "doc_count": 2
    },
    {
        "key": 5,
        "doc_count": 1
    },
    {
        "key": 6,
        "doc_count": 1
    },
]

当我想要类似的东西时:

[
    {
        "Name": "Alex",
        "LastName": "Ich",
        "Department": 2
    },
    {
        "Name": "Charlie",
        "LastName": "Sheen",
        "Department": 3
    },
    {
        "Name": "Peter",
        "LastName": "Petrelli",
        "Department": 5
    },
    {
        "Name": "Alan",
        "LastName": "Harper",
        "Department": 6
    }
]

Answer 1

您可以为此使用Top hits aggregation

{
  "aggs": {
    "departments": {
      "terms": {
        "field": "Department",
        "size": 10
      },
      "aggs": {
        "search_results": {
          "top_hits": {
            "size": 10   <--- you can change the size to 1 if you want
          }
        }
      }
    }
  },
  "size": 0
}

这有帮助吗？