ELASTICSEARCH -从最近的文档中获取值的计数

Question

我无法获得具有筛选的文档值的字段数。

我有这个json

{

"took" : 6,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 2,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "net",
        "_type" : "_doc",
        "_id" : "RTHRTH",
        "_score" : 1.0,
        "_source" : {
          "created_at" : "2020-05-31 19:01:01",
          "data" : [...]
      {
        "_index" : "net",
        "_type" : "_doc",
        "_id" : "LLLoIJBHHM",
        "_score" : 1.0,
        "_source" : {
          "created_at" : "2020-06-23 15:11:59",
          "data" : [...]
        }
      }
    ]
  }
}
``

在“数据”字段中，其他字段中分别有更多的字段。

我想过滤最近的文档，然后在最近的文档中计算某个值。这是我的疑问：

`{
  "query": {
    "match": {
      "name.keyword": "net"
    }
  },
  "sort": [
    {
      "created_at.keyword": {
        "order": "desc"
      }
    }
  ],
  "size": 1,
  "aggs": {
    "CountValue": {
      "terms": {
        "field": "data.add.serv.desc.keyword",
        "include": "nginx"
      }
    }
  }
}`

产出如下：

`{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 2,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "CountValue" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "nginx",
          "doc_count" : 2
        }
      ]
    }
  }`

我怀疑doc_count是该值出现在其中的文档数，而不是在筛选的文档中重复该值的次数。任何建议我都会非常感激！

Answer 1

除非path data.add.serv下的任何字段是嵌套型的字段，否则terms agg将生成每一个完整文档的结果，而不是每个字段。

特惠津贴：

POST example/_doc
{
  "serv": [
    {
      "desc": "nginx"
    },
    {
      "desc": "nginx"
    },
    {
      "desc": "nginx"
    }
  ]
}

then 


GET example/_search
{
  "size": 0,
  "aggs": {
    "NAME": {
      "terms": {
        "field": "serv.desc.keyword"
      }
    }
  }
}

生产doc_count==1。

但是，当指定为nested时

DELETE example

PUT example
{
  "mappings": {
    "properties": {
      "serv": {
        "type": "nested"
      }
    }
  }
}

POST example/_doc
{"serv":[{"desc":"nginx"},{"desc":"nginx"},{"desc":"nginx"}]}

then

GET example/_search
{
  "size": 0,
  "aggs": {
    "NAME": {
      "nested": {
        "path": "serv"
      },
      "aggs": {
        "NAME": {
          "terms": {
            "field": "serv.desc.keyword"
          }
        }
      }
    }
  }
}

我们的结局是doc_count==3。

这与非嵌套数组类型的扁平和反复制方式有关。最后，您可能需要在应用嵌套映射之后重新索引您的集合。

编辑

为了只获取最新的文档，可以执行以下操作：

PUT example
{
  "mappings": {
    "properties": {
      "serv": {
        "type": "nested"
      },
      "created_at": {
        "type": "date",
        "format": "yyyy-MM-dd HH:mm:ss"
      }
    }
  }
}

然后

POST example/_doc
{
  "created_at" : "2020-05-31 19:01:01",
  "serv": [
    {
      "desc": "nginx"
    },
    {
      "desc": "nginx"
    },
    {
      "desc": "nginx"
    }
  ]
}

POST example/_doc
{
  "created_at" : "2020-06-23 15:11:59",
  "serv": [
    {
      "desc": "nginx"
    },
    {
      "desc": "nginx"
    }
  ]
}

然后使用大小为1的术语agg，按时间戳desc排序：

GET example/_search
{
  "size": 0,
  "aggs": {
    "NAME": {
      "terms": {
        "field": "created_at",
        "order": {
          "_term": "desc"
        },
        "size": 1
      },
      "aggs": {
        "NAME2": {
          "nested": {
            "path": "serv"
          },
          "aggs": {
            "NAME": {
              "terms": {
                "field": "serv.desc.keyword"
              }
            }
          }
        }
      }
    }
  }
}