kibana-4 - 在Elasticsearch中对正斜杠使用数据聚合

Question

我有数据，具有这样的属性

apiUrl:/REST/endpoint/123

现在，我想显示所有网址，并尝试使用聚合函数(apiUrl.raw是multifield的not_analyzed部分):

POST /index/type/_search
{
  "aggregations": {
    "application": {
      "terms": {
        "field": "apiUrl.raw"
      }
    }
  }
}

运行此查询时，不会返回任何结果。 我在做什么错？ 我会期待一些事情(以及发生的次数):

/ REST / api1 / 123

/ REST / otherApi / 345

谢谢!

Answer 1

您的查询确实返回非空结果。比较一下，让我们知道有什么区别:

PUT index
PUT index/type/_mapping
{
  "properties" : {
    "apiUrl": {
      "type": "multi_field",
      "fields": {
        "apiUrl": {"type":"string", "index":"analyzed"},
        "raw": {"type":"string", "index":"not_analyzed"}
      }
    }
  }
}
GET index/type/_mapping
PUT index/type/1
{
  "apiUrl":"/REST/api1/123"
}
PUT index/type/2
{
  "apiUrl":"/REST/otherApi/345"
}
GET index/type/_search?fields=apiUrl.raw
GET index/type/_search
{
  "aggregations": {
    "application": {
      "terms": {
        "field": "apiUrl.raw"
      }
    }
  }
}

响应:

{
   "took": 76,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 2,
      "max_score": 1,
      "hits": [
         {
            "_index": "index",
            "_type": "type",
            "_id": "1",
            "_score": 1,
            "_source": {
               "apiUrl": "/REST/api1/123"
            }
         },
         {
            "_index": "index",
            "_type": "type",
            "_id": "2",
            "_score": 1,
            "_source": {
               "apiUrl": "/REST/otherApi/345"
            }
         }
      ]
   },
   "aggregations": {
      "application": {
         "doc_count_error_upper_bound": 0,
         "sum_other_doc_count": 0,
         "buckets": [
            {
               "key": "/REST/api1/123",
               "doc_count": 1
            },
            {
               "key": "/REST/otherApi/345",
               "doc_count": 1
            }
         ]
      }
   }
}