elasticsearch 聚合 - 为什么匹配所有查询不返回更具体查询的键？

Question

我正在做一些聚合。但是结果完全不是我所期望的，似乎它们没有聚合索引中与我的查询匹配的所有文档，在这种情况下 - 它有什么好处？

例如，首先我做这个查询:

{"index":"datalayer","type":"analysis2","body":{"query":{
        "match_all" : {}
    },
    "aggs" : {
        "objects" : {
            "terms" : {
              "field" : "action"
            }
        }
    }
}}

结果是 500 次点击，聚合如下:

"aggregations": {
    "objects": {
        "buckets": [
            {
                "key": "thing",
                "doc_count": 278
            },
            {
                "key": "hover",
                "doc_count": 273
            },
            {
                "key": "embedded",
                "doc_count": 57
            },
            {
                "key": "view",
                "doc_count": 50
            },
            {
                "key": "widgets",
                "doc_count": 49
            },
            {
                "key": "hovered",
                "doc_count": 20
            },
            {
                "key": "widgetembed",
                "doc_count": 20
            },
            {
                "key": "products",
                "doc_count": 19
            },
            {
                "key": "create",
                "doc_count": 15
            },
            {
                "key": "image",
                "doc_count": 13
            }
        ]
    }
}

这一切都很好，但我知道我有一些应该激活的地方。
所以如果我再做查询

{"index":"datalayer","type":"analysis2","body":{"query":{
        "bool": {
        "must" : [
            {"match": {"object": "Widget"}}
        ]
    }},
    "aggs" : {
        "objects" : {
            "terms" : {
              "field" : "action"
            }
        }
    }
}}

那么结果是 45 次点击聚合

"aggregations": {
        "objects": {
            "buckets": [
                {
                    "key": "widgets",
                    "doc_count": 41
                },
                {
                    "key": "embedded",
                    "doc_count": 40
                },
                {
                    "key": "view",
                    "doc_count": 32
                },
                {
                    "key": "activation",
                    "doc_count": 9
                },
                {
                    "key": "image",
                    "doc_count": 4
                },
                {
                    "key": "create",
                    "doc_count": 3
                },
                {
                    "key": "mapping",
                    "doc_count": 3
                },
                {
                    "key": "widget",
                    "doc_count": 3
                },
                {
                    "key": "adding",
                    "doc_count": 2
                },
                {
                    "key": "edit",
                    "doc_count": 1
                }
            ]
        }
    }

从这些聚合中可以看出，我有一些键不在我的第一个匹配所有文档的操作聚合中。这是为什么？我该怎么做才能得到一个包含所有文档操作的存储桶。

我不认为这可能只是我需要做分页或其他事情，因为我也尝试过

{"index":"datalayer","type":"analysis2","body":{"from":0,"size":500,"query":{
        "match_all" : {}
    },
    "aggs" : {
        "objects" : {
            "terms" : {
              "field" : "action"
            }
        }
    }
}}

具有完全相同的聚合结果

"aggregations": {
    "objects": {
        "buckets": [
            {
                "key": "thing",
                "doc_count": 278
            },
            {
                "key": "hover",
                "doc_count": 273
            },
            {
                "key": "embedded",
                "doc_count": 57
            },
            {
                "key": "view",
                "doc_count": 50
            },
            {
                "key": "widgets",
                "doc_count": 49
            },
            {
                "key": "hovered",
                "doc_count": 20
            },
            {
                "key": "widgetembed",
                "doc_count": 20
            },
            {
                "key": "products",
                "doc_count": 19
            },
            {
                "key": "create",
                "doc_count": 15
            },
            {
                "key": "image",
                "doc_count": 13
            }
        ]
    }
}

所以，我希望有人可以向我解释为什么我没有看到我在这里期待的桶中的 key ？

Answer 1

来自 the documentation :

By default, the terms aggregation will return the buckets for the top ten terms ordered by the doc_count. One can change this default behaviour by setting the size parameter.

因此，您需要指定 "size"大于 10 的数字以查看更多存储桶。或设置为 0看到所有的桶。来自相同的文档:

If set to 0, the size will be set to Integer.MAX_VALUE.

   "aggs" : {
        "objects" : {
            "terms" : {
              "field" : "action",
              "size": 0
            }
        }
    }