如何在多个字段上编写弹性聚合

huangapple go评论46阅读模式
英文:

How to write a Elastic Aggregation on multiple fields

问题

我有一个需求,需要聚合 Elastic Search 上的多个字段。

我有一个名为"Working days"的嵌套字段,以下是该字段的映射。

"workingDays": {
	"type": "nested",
	"properties": {
		"mon": {
			"type": "nested",
			"properties": {
				"availability": {
					"type": "boolean"
				},
				"title": {
					"type": "text",
					"fields": {
						"keyword": {
						   "type": "keyword"
						 }
					}
				},
				"notes": {
					"type": "text"
				}
			}
		},
        "tue": {
			"type": "nested",
			"properties": {
				"availability": {
					"type": "boolean"
				},
				"title": {
					"type": "text",
					"fields": {
						"keyword": {
						   "type": "keyword"
						 }
					}
				},
				"notes": {
					"type": "text"
				}
			}
		}
	}
}

这样,映射会针对所有的日期继续进行。

现在,数据如下所示。

"workingdays": {
	"mon": {
		"availability": true,
		"title": "Monday",
		"notes": ""
	},
	"tue": {
		"title": "Tuesday",
		"notes": "On Tuesdays, drop off and pick up times must be scheduled between 12pm to 2pm",
		"availability": false
	}
}

因此,我的需求如下。我需要聚合并返回所有特定日期上可用的数据,类似于以下内容。

"buckets": [
   {
	  "key": "Monday",
	  "doc_count": 3
   },
   {
	  "key": "Tuesday",
	  "doc_count": 5
   }
]

我尝试了嵌套聚合、组合聚合和多字段聚合,但都没有得到可用的格式。

英文:

I'm having a requirement to aggregate the Elastic Search on multiple fields.

I have a nested field called Working days and below is the mapping for the same.

"workingDays": {
	"type": "nested",
	"properties": {
		"mon": {
			"type": "nested",
			"properties": {
				"availability": {
					"type": "boolean"
				},
				"title": {
					"type": "text",
                    "fields": {
                        "keyword": {
                           "type": "keyword"
                         }
                    }
				},
				"notes": {
					"type": "text"
				}
			}
		},
        "tue": {
			"type": "nested",
			"properties": {
				"availability": {
					"type": "boolean"
				},
				"title": {
					"type": "text",
                    "fields": {
                        "keyword": {
                           "type": "keyword"
                         }
                    }
				},
				"notes": {
					"type": "text"
				}
			}
		}
	}
}

In this way, the mapping goes on for all the days.

Now, the data is shown as below

"workingdays": {
		"mon": {
			"availability": true,
			"title": "Monday",
			"notes": ""
		},
		"tue": {
			"title": "Tuesday",
			"notes": "On Tuesdays, drop off and pick up times must be scheduled between 12pm to 2pm",
			"availability": false
		}
	}

So, my requirement is as follows. I need to aggregate and result in all the data which are available on specific days, something similar to this.

"buckets": [
   {
	  "key": "Monday",
	  "doc_count": 3
   },
   {
	  "key": "Tuesday",
	  "doc_count": 5
   }
]

I have tried nested aggregation, composition aggregation, and multi-field aggregation but none of them resulted in a usable format.

答案1

得分: 1

您可以在嵌套聚合内使用嵌套聚合,然后在嵌套聚合内使用过滤聚合 :).

PUT test_days
{
  "mappings": {
    "properties": {
      "workingdays": {
        "type": "nested",
        "properties": {
          "mon": {
            "type": "nested",
            "properties": {
              "availability": {
                "type": "boolean"
              },
              "title": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword"
                  }
                }
              },
              "notes": {
                "type": "text"
              }
            }
          },
          "tue": {
            "type": "nested",
            "properties": {
              "availability": {
                "type": "boolean"
              },
              "title": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword"
                  }
                }
              },
              "notes": {
                "type": "text"
              }
            }
          }
        }
      }
    }
  }
}
POST test_days/_doc?refresh
{
  "workingdays": {
    "mon": {
      "availability": true,
      "title": "Monday",
      "notes": ""
    },
    "tue": {
      "title": "Tuesday",
      "notes": "On Tuesdays, drop off and pick up times must be scheduled between 12pm to 2pm",
      "availability": false
    }
  }
}
GET test_days/_search
{
  "size": 0,
  "aggs": {
    "total": {
      "nested": {
        "path": "workingdays"
      },
      "aggs": {
        "monday": {
          "filters": {
            "filters": {
              "monday_availability": {
                "nested": {
                  "path": "workingdays.mon",
                  "query": {
                    "term": {
                      "workingdays.mon.availability": {
                        "value": true
                      }
                    }
                  }
                }
              },
              "tuesday_availability": {
                "nested": {
                  "path": "workingdays.tue",
                  "query": {
                    "term": {
                      "workingdays.tue.availability": {
                        "value": true
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

注意:区分大小写!请仔细检查是否使用了workingDaysworkingdays

英文:

You can use nested aggregations inside of filter aggregation inside of nested aggregation :).

PUT test_days
{
  "mappings": {
    "properties": {
      "workingdays": {
        "type": "nested",
        "properties": {
          "mon": {
            "type": "nested",
            "properties": {
              "availability": {
                "type": "boolean"
              },
              "title": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword"
                  }
                }
              },
              "notes": {
                "type": "text"
              }
            }
          },
          "tue": {
            "type": "nested",
            "properties": {
              "availability": {
                "type": "boolean"
              },
              "title": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword"
                  }
                }
              },
              "notes": {
                "type": "text"
              }
            }
          }
        }
      }
    }
  }
}

POST test_days/_doc?refresh
{
  "workingdays": {
    "mon": {
      "availability": true,
      "title": "Monday",
      "notes": ""
    },
    "tue": {
      "title": "Tuesday",
      "notes": "On Tuesdays, drop off and pick up times must be scheduled between 12pm to 2pm",
      "availability": false
    }
  }
}

GET test_days/_search
{
  "size": 0,
  "aggs": {
    "total": {
      "nested": {
        "path": "workingdays"
      },
      "aggs": {
        "monday": {
          "filters": {
            "filters": {
              "monday_availability": {
                "nested": {
                  "path": "workingdays.mon",
                  "query": {
                    "term": {
                      "workingdays.mon.availability": {
                        "value": true
                      }
                    }
                  }
                }
              },
              "tuesday_availability": {
                "nested": {
                  "path": "workingdays.tue",
                  "query": {
                    "term": {
                      "workingdays.tue.availability": {
                        "value": true
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

Note: case sensitive!! double check if you are using workingDays or workingdays.

如何在多个字段上编写弹性聚合

huangapple
  • 本文由 发表于 2023年6月6日 14:55:01
  • 转载请务必保留本文链接:https://go.coder-hub.com/76412116.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定