使用Elasticsearch聚合查找桶的並集或相交

Question

我有嵌套的聚合，並且我想根據我的第一個聚合存儲桶結果上的條件找到第二個聚合存儲桶的並集或交集。例如，這就是我的聚合。

    "aggs": {
    "events": {
        "terms": {
            "field": "event_name"
        },
        "aggs":{
            "devices":{
                "terms":{
                    "field": "device-id"
                }
            }
        }
    }

}

這是我聚合的結果

 "aggregations": {
  "events": {
     "doc_count_error_upper_bound": 0,
     "sum_other_doc_count": 0,
     "buckets": [
        {
           "key": "conversion_checkout",
           "doc_count": 214,
           "devices": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 6,
              "buckets": [
                 {
                    "key": "9a11f243d44",
                    "doc_count": 94
                 },
                 {
                    "key": "ddcb21fd6cb",
                    "doc_count": 35
                 }

              ]
           }
        },
        {
           "key": "action_view_product",
           "doc_count": 5,
           "devices": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 0,
              "buckets": [
                 {
                    "key": "54E4C593",
                    "doc_count": 4
                 },
                 {
                    "key": "9a11f243d44",
                    "doc_count": 1
                 }
              ]
           }
        }
     ]
  }

}

現在，如果我想查找所有已完成action_view_product和conversion_checkout的設備，我該如何進行匯總？

Answer 1

我認為您希望獲得具有event_names action_view_product和conversion_checkout的所有設備ID，如下所示：

{  
   "aggregations":{  
      "devices_agg":{  
         "doc_count":516,
         "devices":{  
            "doc_count_error_upper_bound":0,
            "sum_other_doc_count":0,
            "buckets":[  
               {  
                  "key":623232334,
                  "doc_count":275
               },
               {  
                  "key":245454512,
                  "doc_count":169
               },
               {  
                  "key":345454567,
                  "doc_count":32
               },
               {  
                  "key":578787565,
                  "doc_count":17
               },
               {  
                  "key":146272715,
                  "doc_count":23
               }
            ]
         }
      }
   }
}

doc_count = 516是具有event_name或action_view_product或conversion_checkout的文檔總數，並且設備聚合中的“關鍵字”是device-id。

如果我答對了，那么下面的查詢將為您完成此任務-

{
   "size": 0,
   "aggs": {
      "devices_agg": {
         "filter": {
            "bool": {
               "must": [
                  {
                     "terms": {
                        "event_name": [
                           "action_view_product",
                           "conversion_checkout"
                        ]
                     }
                  }
               ]
            }
         },
         "aggs": {
            "devices": {
               "terms": {
                  "field": "device-id",
                  "size": 100
               }
            }
         }
      }
   }
}

如果我弄錯了，請告訴我。