对数组项进行过滤的 ElasticSearch 聚合

Question

我想用一些额外的逻辑做一个聚合请求，但我不确定这是否可能以及如何做。当我有以下文件时，我如何请求数组中没有定义“类型”的位置？我尝试在类型上发送子聚合过滤器，但随后位置“20”也在该聚合上得到 doc_count 1。

在这种情况下，如何对匹配的聚合项做一些逻辑？

文件：

    //document1
{
        "locations": [{
                "code": "20",
                "names": [{
                        "languageCode": "en-GB",
                        "value": "Amsterdam"
                    }
                ]
            }, {
                "type": {
                    "id": 25,
                    "names": [{
                            "languageCode": "en-GB",
                            "value": "area"
                        }
                    ]
                },
                "code": "21",
                "names": [{
                        "languageCode": "en-GB",
                        "value": "Amsterdam-South"
                    }
                ]
            }
        ]
    }
//Document 2
    {
        "locations": [{
                "code": "22",
                "names": [{
                        "languageCode": "en-GB",
                        "value": "DenHague"
                    }, {
                        "languageCode": "nl-NL",
                        "value": "DenHaag"
                    }
                ]
            }
        ]
    }

要求：

{
    "aggs": {
        "Filter_Location": {
            "aggs": {
                "SubType": {
                    "filter": {
                        "exists": {
                            "field": "locations.type"
                        }
                    }
                }           },
            "terms": {
                "field": "locations.code.keyword"
            }
        }
    },
    "size": 0
}

结果：

{
    "aggregations": {
        "Filter_Location": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [{
                    "key": "20",
                    "doc_count": 1,
                    "SubType": {
                        "doc_count": 1
                    },
                    "groupByAccoId": {
                        "value": 1
                    }
                }, {
                    "key": "21",
                    "doc_count": 1,
                    "SubType": {
                        "doc_count": 1
                    },
                    "groupByAccoId": {
                        "value": 1
                    }
                }, {
                    "key": "22",
                    "doc_count": 1,
                    "SubType": {
                        "doc_count": 0
                    },
                    "groupByAccoId": {
                        "value": 1
                    }
                }
            ]
        }
    }
}

预期结果：

{
    "aggregations": {
        "Filter_Location": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [{
                    "key": "20",
                    "doc_count": 1,
                    "SubType": {
                        "doc_count": 0
                    }
                }, {
                    "key": "21",
                    "doc_count": 1,
                    "SubType": {
                        "doc_count": 1
                    }
                }, {
                    "key": "22",
                    "doc_count": 1,
                    "SubType": {
                        "doc_count": 0
                    }
                }
            ]
        }
    }
}

Answer 1

为了防止 locations array flattening 您需要将索引映射设置为 nested:

PUT ind
{
  "mappings": {
    "properties": {
      "locations": {
        "type": "nested"
      }
    }
  }
}

提取文档后，此查询将为您获取所需的结果：

GET ind/_search
{
  "size": 0,
  "aggs": {
    "Filter_Location_parent": {
      "nested": {
        "path": "locations"
      },
      "aggs": {
        "Filter_Location": {
          "terms": {
            "field": "locations.code.keyword"
          },
          "aggs": {
            "SubType": {
              "filter": {
                "exists": {
                  "field": "locations.type"
                }
              }
            }
          }
        }
      }
    }
  }
}