ElasticSearch 聚合過濾器（非嵌套）數組

Question

我有這樣的映射：

PUT myindex1/_mapping
{
  "properties": {
    "program":{
        "properties":{
            "rounds" : {
                "properties" : {
                    "id" : {
                    "type" : "keyword"
                    },
                    "name" : {
                        "type" : "text",
                        "fields" : {
                            "keyword" : {
                            "type" : "keyword",
                            "ignore_above" : 256
                            }
                        }
                    }
                } 
            }
        }
    }
  }
}

我的示例文檔：

POST myindex1/_doc
{
  "program": {
    "rounds":[
      {"id":"00000000-0000-0000-0000-000000000000", "name":"Test1"},
      {"id":"00000000-0000-0000-0000-000000000001", "name":"Fact2"}
    ]
  }
}

POST myindex1/_doc
{
  "program": {
    "rounds":[
      {"id":"00000000-0000-0000-0000-000000000002", "name":"Test3"},
      {"id":"00000000-0000-0000-0000-000000000003", "name":"Fact4"}
    ]
  }
}

POST myindex1/_doc
{
  "program": {
    "rounds":[
      {"id":"00000000-0000-0000-0000-000000000004", "name":"Test5"},
      {"id":"00000000-0000-0000-0000-000000000005", "name":"Fact6"}
    ]
  }
}

目的：僅獲取用戶過濾為通配符的回合名稱。 聚合查詢：

GET myindex1/_search
{
  "aggs": {
        "result": {
          "aggs": {
            "names": {
              "terms": {
                "field": "program.rounds.name.keyword",
                "size": 10000,
                "order": {
                  "_key": "asc"
                }
              }
            }
          },
          "filter": {
            "bool": {
              "must":[
                {
                  "wildcard": {
                    "program.rounds.name": "*test*"
                  }
                }
              ]
            }
          }
        }
    },
    "size": 0
}

此聚合返回所有 6 個名稱，但我只需要Test1,Test3,Test5 。 還嘗試了include": "/tes.*/i"正則terms模式，但忽略大小寫不起作用。注意：我注意到肯定有嵌套類型，因為我對Id和Name之間的關聯不感興趣（在至少現在）。ElasticSearch 版本：7.7.0

Answer 1

如果您只想根據 name 字段上的條件聚合特定輪次，則需要進行rounds nested ，否則所有名稱值最終都在同一個字段中。

您的映射需要更改為：

PUT myindex1/
{
  "mappings": {
    "properties": {
      "program": {
        "properties": {
          "rounds": {
            "type": "nested",             <--- add this
            "properties": {
              "id": {
                "type": "keyword"
              },
              "name": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword",
                    "ignore_above": 256
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

然后您的查詢需要更改為：

GET myindex1/_search
{
  "size": 0,
  "query": {
    "nested": {
      "path": "program.rounds",
      "query": {
        "bool": {
          "must": [
            {
              "wildcard": {
                "program.rounds.name": "*Test*"
              }
            }
          ]
        }
      }
    }
  },
  "aggs": {
    "rounds": {
      "nested": {
        "path": "program.rounds"
      },
      "aggs": {
        "name_filter": {
          "filter": {
            "wildcard": {
              "program.rounds.name": "*Test*"
            }
          },
          "aggs": {
            "names": {
              "terms": {
                "field": "program.rounds.name.keyword",
                "size": 10000,
                "order": {
                  "_key": "asc"
                }
              }
            }
          }
        }
      }
    }
  }
}

結果將是：

  "aggregations" : {
    "rounds" : {
      "doc_count" : 6,
      "name_filter" : {
        "doc_count" : 3,
        "names" : {
          "doc_count_error_upper_bound" : 0,
          "sum_other_doc_count" : 0,
          "buckets" : [
            {
              "key" : "Test1",
              "doc_count" : 1
            },
            {
              "key" : "Test3",
              "doc_count" : 1
            },
            {
              "key" : "Test5",
              "doc_count" : 1
            }
          ]
        }
      }
    }
  }

更新：

實際上，您可以通過以下查詢在不引入嵌套類型的情況下實現您想要的。 你很接近，但include模式是錯誤的

GET myindex1/_search
{
  "aggs": {
    "result": {
      "aggs": {
        "names": {
          "terms": {
            "field": "program.rounds.name.keyword",
            "size": 10000,
            "include": "[Tt]est.*",
            "order": {
              "_key": "asc"
            }
          }
        }
      },
      "filter": {
        "bool": {
          "must": [
            {
              "wildcard": {
                "program.rounds.name": "*Test*"
              }
            }
          ]
        }
      }
    }
  },
  "size": 0
}