嵌套聚合，術語 -> 術語 -> 計數 Elasticsearch

Question

我的文檔示例：

[
  {
    username: 'userA',
    action: 'click',
    page: 'home'
  },
  {
    username: 'userA',
    action: 'click',
    page: 'home'
  },
  {
    username: 'userA',
    action: 'scroll',
    page: 'home'
  },
  {
    username: 'userA',
    action: 'click',
    page: 'productA'
  },
  {
    username: 'userB',
    action: 'scroll',
    page: 'productA'
  },
  ...
]

我需要的嵌套聚合示例：

{
  userA: {
    home: {
      click: 2,
      scroll: 1
    },
    productA: {
      click: 1
    },
  },
  userB: {
    productA: {
      scroll: 1
    }
  }
  ...
}

到目前為止我有這段代碼，但我不知道如何嵌套：

POST /index/_search?size=0
{
  "aggs" : {
    "usernames" : { 
      "terms": { 
        "field" : "username.keyword",
        "size": 10000
      }
    }
  }
}

這給了我所有的用戶名，這是一個好的開始，但我如何獲得每個用戶名的第二個嵌套聚合？

Answer 1

下面是一個檢索所需數據的示例。

Elasticsearch 有一種盒裝格式來表示這種帶有嵌套桶的聚合。

您必須解析響應以准確檢索您在問題中描述的格式:)

POST myindex/_search
{
    "size": 0,
    "aggs": {
      "by_name": {
        "terms": {
          "field": "username.keyword",
          "size": 10
        },
        "aggs": {
          "by_action": {
            "terms": {
              "field": "action.keyword",
              "size": 10
            },
            "aggs": {
              "by_page": {
                "terms": {
                  "field": "page.keyword",
                  "size": 10
                }
              }
            }
          }
        }
      }
    }
  }

響應（聚合部分）：

"aggregations": {
    "by_name": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "userA",
          "doc_count": 3,
          "by_action": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "click",
                "doc_count": 3,
                "by_page": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                    {
                      "key": "home",
                      "doc_count": 2
                    },
                    {
                      "key": "productA",
                      "doc_count": 1
                    }
                  ]
                }
              }
            ]
          }
        },
        {
          "key": "userB",
          "doc_count": 1,
          "by_action": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "scroll",
                "doc_count": 1,
                "by_page": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                    {
                      "key": "productA",
                      "doc_count": 1
                    }
                  ]
                }
              }
            ]
          }
        }
      ]
    }
  }