包含字符串字段的对象上的嵌套术语聚合

Question

我喜欢运行对象内部字符串字段上的嵌套术语聚合。

通常，我使用这个查询

      "terms": {
        "field": "fieldname.keyword"
      }

启用字段数据

但是我无法对这样的嵌套文档执行此操作

{
      "nested": {
        "path": "objectField"
      },
      "aggs": {
        "allmyaggs": {
          "terms": {
            "field": "objectField.fieldName.keyword"
          }
        }
      }
    }

上面的查询只是返回一个空的 buckets 数组

有没有一种方法可以做到这一点，而无需在索引映射期间默认启用字段数据。因为那会占用很大的堆内存，而且我已经在没有它的情况下加载了大量数据

文档映射

{
  "mappings": {
    "properties": {
      "productname": {
        "type": "nested",
        "properties": {
          "productlineseqno": {
            "type": "text"
          },
          "invoiceitemname": {
            "type": "text"
          },
          "productlinename": {
            "type": "text"
          },
          "productlinedescription": {
            "type": "text"
          },
          "isprescribable": {
            "type": "boolean"
          },
          "iscontrolleddrug": {
            "type": "boolean"
          }
        }
      }

示例文档

{
  "productname": [
    {
      "productlineseqno": "1.58",
      "iscontrolleddrug": "false",
      "productlinename": "Consultations",
      "productlinedescription": "Consultations",
      "isprescribable": "false",
      "invoiceitemname": "invoice name"
    }
  ]
}

固定

通过更改映射以启用字段数据

Answer 1

嵌套查询用于访问嵌套字段，类似地nested aggregation需要对嵌套字段进行聚合

{
  "aggs": {
    "fieldname": {
      "nested": {
        "path": "objectField"
      },
      "aggs": {
        "fields": {
          "terms": {
            "field": "objectField.fieldname.keyword",
            "size": 10
          }
        }
      }
    }
  }
}

编辑 1：

如果您正在搜索 productname.invoiceitemname.keyword，那么它会给出空的存储桶，因为不存在具有该名称的字段。

您需要像下面这样定义您的映射

{
  "mappings": {
    "properties": {
      "productname": {
        "type": "nested",
        "properties": {
          "productlineseqno": {
            "type": "text"
          },
          "invoiceitemname": {
            "type": "text",
            "fields":{       --> note
              "keyword":{
                "type":"keyword"
              }
            }
          },
          "productlinename": {
            "type": "text"
          },
          "productlinedescription": {
            "type": "text"
          },
          "isprescribable": {
            "type": "boolean"
          },
          "iscontrolleddrug": {
            "type": "boolean"
          }
        }
      }
    }
  }
}

Fields

It is often useful to index the same field in different ways for different purposes. This is the purpose of multi-fields. For instance, a string field could be mapped as a text field for full-text search, and as a keyword field for sorting or aggregations:

当未明确提供映射时，默认创建关键字字段。如果您正在创建自己的映射（您需要为嵌套类型执行此操作），则需要在映射中提供关键字字段，无论您打算在何处使用它们

包含字符串字段的对象上的嵌套术语聚合

nested terms aggregation on object containing a string field

elasticsearch

elastic-stack