按 es 中的嵌套和非嵌套字段分组

Question

你好，我正在尝试按嵌套和非嵌套进行分组 fields.I 想按 1 个非嵌套字段（from_district），1 个嵌套字段（truck_number）进行分组和嵌套字段的最大值 (truck_number.score).

要求 -: 如果给定的sp_id区域中存在卡车，则获得所有区域中每辆卡车的最高分例如-:

District1 ,truck1, 0.9,
District2 ,truck1, 0.8,
District1 ,truck2, 1.8,
District2 ,truck3, 0.7,
District3 ,truck4, 1.7

下面是我的映射

{
  "sp_ranked_indent" : {
    "mappings" : {
      "properties" : {
        "from_district" : {
          "type" : "keyword"
        },
        "sp_id" : {
          "type" : "long"
        },
        "to_district" : {
          "type" : "keyword"
        },
        "truck_ranking_document" : {
          "type" : "nested",
          "properties" : {
            "score" : {
              "type" : "float"
            },
            "truck_number" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        }
      }
    }
  }
}

下面是我试过的查询，但它没有按嵌套和非嵌套字段分组，而且最大卡车得分也不正确

{
    "size": 0,
    "query": {
        "terms": {
            "sp_id": [650128],
            "boost": 1.0
        }
    },
    "aggregations": {
        "NESTED_AGG": {
            "nested": {
                "path": "truck_ranking_document"
            },
            "aggregations": {
                "max_score": {
                    "max": {
                        "field": "truck_ranking_document.score"
                    }
                },
                "truck_numer": {
                    "terms": {
                        "field": "truck_ranking_document.truck_number.keyword",
                        "size": 10,
                        "min_doc_count": 1,
                        "shard_min_doc_count": 0,
                        "show_term_doc_count_error": false,
                        "order": [{
                            "_count": "desc"
                        }, {
                            "_key": "asc"
                        }]
                    }
                },
                "fromdistrictagg": {
                    "reverse_nested": {},
                    "aggregations": {
                        "fromDistrict": {
                            "terms": {
                                "field": "from_district",
                                "size": 10,
                                "min_doc_count": 1,
                                "shard_min_doc_count": 0,
                                "show_term_doc_count_error": false,
                                "order": [{
                                    "_count": "desc"
                                }, {
                                    "_key": "asc"
                                }]
                            }
                        }
                    }
                }
            }
        }
    }
}

Answer 1

我认为这可以使用术语和嵌套聚合来完成。下面的查询将产生以下格式的输出

  District1 
        Truck1
             Max score
        Truck2
             Max score
        Truck3
             Max score
  District2
        Truck1
             Max score
        Truck2
             Max score
        Truck3
             Max score

查询:

{
  "query": {
    "terms": {
      "sp_id": [
        1
      ]
    }
  },
  "aggs": {
    "district": {
      "terms": {
        "field": "from_district",
        "size": 10
      },
      "aggs": {
        "trucks": {
          "nested": {
            "path": "truck_ranking_document"
          },
          "aggs": {
            "truck_no": {
              "terms": {
                "field": "truck_ranking_document.truck_number.keyword",
                "size": 10
              },
              "aggs": {
                "max_score": {
                  "max": {
                    "field": "truck_ranking_document.score"
                  }
                },
                "select": {
                  "bucket_selector": {
                    "buckets_path": {
                      "score": "max_score"
                    },
                    "script": "if(params.score>0) return true;"
                  }
                }
              }
            }
          }
        },
        "min_bucket_selector": {
          "bucket_selector": {
            "buckets_path": {
              "count": "trucks>truck_no._bucket_count"
            },
            "script": {
              "inline": "params.count != 0"
            }
          }
        }
      }
    }
  }
}

结果：

"aggregations" : {
    "district" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "District1",
          "doc_count" : 1,
          "trucks" : {
            "doc_count" : 2,
            "truck_no" : {
              "doc_count_error_upper_bound" : 0,
              "sum_other_doc_count" : 0,
              "buckets" : [
                {
                  "key" : "1",
                  "doc_count" : 1,
                  "max_score" : {
                    "value" : 2.0
                  }
                },
                {
                  "key" : "3",
                  "doc_count" : 1,
                  "max_score" : {
                    "value" : 3.0
                  }
                }
              ]
            }
          }
        }
      ]
    }

Composite Aggregation

复合聚合响应包含 after_key

"after_key" : {
        "district" : "District4"
      }

您需要使用 after 参数来检索下一个结果

{
  "aggs": {
    "my_buckets": {
      "composite": {
       "size": 100,
        "sources": [
          {
            "district": {
              "terms": {
                "field": "from_district"
              }
            }
          }
        ]
      },
      "aggs": {
        "trucks": {
          "nested": {
            "path": "truck_ranking_document"
          },
          "aggs": {
            "truck_no": {
              "terms": {
                "field": "truck_ranking_document.truck_number.keyword",
                "size": 10
              },
              "aggs": {
                "max_score": {
                  "max": {
                    "field": "truck_ranking_document.score"
                  }
                },
                "select": {
                  "bucket_selector": {
                    "buckets_path": {
                      "score": "max_score"
                    },
                    "script": "if(params.score>0) return true;"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

按 es 中的嵌套和非嵌套字段分组

group by nested and non nested fields in es

elasticsearch

elastic-stack

elasticsearch-aggregation