在elasticsearch中如何根据输入字段求出字段的和值(输入字段和和输出字段是不同的)

Question

这是弹性搜索中的文档，它希望输出基于数据的字段，在这些字段中，它返回高和中等的和，并且大于零，高和介质的值必须大于0。

         {
            "host_id": 1,
            "hostname": "Hostname1",
            "businesshierarchy": {
                "businessunit": "NON Unit",
                "Location":"Un",
                "Application":"App1"
            },
            "updatedts": 1601894092,
            "critical": 0,
            "high": 1,
            "medium": 1,
            "low": 0
        },
        {
            "host_id": 2,
            "hostname": "Hostname2",
            "businesshierarchy": {
                "businessunit": "One Unit",
                "Location":"Un",
                "Application":"App2"
            },
            "updatedts": 1601894092,
            "critical": 0,
            "high": 1,
            "medium": 2,
            "low": 0
        },
        {
            "host_id": 3,
            "hostname": "Hostname3",
            "businesshierarchy": {
                "businessunit": "NON Unit",
                "Location":"Uk",
                "Application":"App2"
            },
            "updatedts": 1601894092,
            "critical": 0,
            "high": 2,
            "medium": 2,
            "low": 0
        } 

是否有类似弹性搜索的查询或方法来获得输出？

基于位置的

地点- Un High -2中等-3

位置-英国高2中等- 2

基于应用的

应用- App1高-1介质-1

应用- App2高3介质- 4

1. 或基于主机名

主机名- Hostname1高-1中等-1

主机名- Hostname2高-1中等-2

主机名- Hostname3 High -2 medi-2

商务活动也是如此。像businessunit、主机名、应用程序、位置这样动态传递的字段名是基于它的，希望得到像上面的输出那样的计数高和中等值。

Answer 1

添加具有索引映射、索引数据(与所述数据相同)、搜索查询和搜索结果的工作示例。

索引映射：

{
  "mappings": {
    "properties": {
      "hostname": {
        "type": "keyword"
      },
      "businesshierarchy": {
        "properties": {
          "Location": {
            "type": "keyword"
          },
          "Application": {
            "type": "keyword"
          }
        }
      }
    }
  }
}

搜索查询：

{
  "size": 0,
  "aggs": {
    "user": {
      "terms": {
        "field": "businesshierarchy.Location"
      },
      "aggs": {
        "top_user_hits": {
          "top_hits": {
            "_source": {
              "includes": [
                "high",
                "medium"
              ]
            }
          }
        },
        "high_sum": {
          "sum": {
            "field": "high"
          }
        },
        "medium_sum": {
          "sum": {
            "field": "medium"
          }
        }
      }
    }
  }
}

搜索结果：

基于位置的

"aggregations": {
    "user": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "Un",
          "doc_count": 2,
          "top_user_hits": {
            "hits": {
              "total": {
                "value": 2,
                "relation": "eq"
              },
              "max_score": 1.0,
              "hits": [
                {
                  "_index": "stof_64218649",
                  "_type": "_doc",
                  "_id": "1",
                  "_score": 1.0,
                  "_source": {
                    "high": 1,
                    "medium": 1
                  }
                },
                {
                  "_index": "stof_64218649",
                  "_type": "_doc",
                  "_id": "2",
                  "_score": 1.0,
                  "_source": {
                    "high": 1,
                    "medium": 2
                  }
                }
              ]
            }
          },
          "high_sum": {
            "value": 2.0       <-- note this
          },
          "medium_sum": {
            "value": 3.0
          }
        },
        {
          "key": "Uk",
          "doc_count": 1,
          "top_user_hits": {
            "hits": {
              "total": {
                "value": 1,
                "relation": "eq"
              },
              "max_score": 1.0,
              "hits": [
                {
                  "_index": "stof_64218649",
                  "_type": "_doc",
                  "_id": "3",
                  "_score": 1.0,
                  "_source": {
                    "high": 2,
                    "medium": 2
                  }
                }
              ]
            }
          },
          "high_sum": {
            "value": 2.0                       <-- note this
          },
          "medium_sum": {
            "value": 2.0
          }
        }
      ]
    }

用于基于应用程序的查询的替换术语聚合，如下所示：

"aggs": {
        "user": {
          "terms": {
            "field": "businesshierarchy.Application"
          },

搜索结果如下：

 "aggregations": {
    "user": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "App2",
          "doc_count": 2,
          "top_user_hits": {
            "hits": {
              "total": {
                "value": 2,
                "relation": "eq"
              },
              "max_score": 1.0,
              "hits": [
                {
                  "_index": "stof_64218649",
                  "_type": "_doc",
                  "_id": "3",
                  "_score": 1.0,
                  "_source": {
                    "high": 2,
                    "medium": 2
                  }
                },
                {
                  "_index": "stof_64218649",
                  "_type": "_doc",
                  "_id": "2",
                  "_score": 1.0,
                  "_source": {
                    "high": 1,
                    "medium": 2
                  }
                }
              ]
            }
          },
          "high_sum": {
            "value": 3.0
          },
          "medium_sum": {
            "value": 4.0
          }
        },
        {
          "key": "App1",
          "doc_count": 1,
          "top_user_hits": {
            "hits": {
              "total": {
                "value": 1,
                "relation": "eq"
              },
              "max_score": 1.0,
              "hits": [
                {
                  "_index": "stof_64218649",
                  "_type": "_doc",
                  "_id": "1",
                  "_score": 1.0,
                  "_source": {
                    "high": 1,
                    "medium": 1
                  }
                }
              ]
            }
          },
          "high_sum": {
            "value": 1.0
          },
          "medium_sum": {
            "value": 1.0
          }
        }
      ]
    }

用于基于主机名的查询的替换术语聚合，如下所示：

"aggs": {
    "user": {
      "terms": {
        "field": "hostname"
      },

搜索结果如下：

"aggregations": {
    "user": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "Hostname1",
          "doc_count": 1,
          "top_user_hits": {
            "hits": {
              "total": {
                "value": 1,
                "relation": "eq"
              },
              "max_score": 1.0,
              "hits": [
                {
                  "_index": "stof_64218649",
                  "_type": "_doc",
                  "_id": "1",
                  "_score": 1.0,
                  "_source": {
                    "high": 1,
                    "medium": 1
                  }
                }
              ]
            }
          },
          "high_sum": {
            "value": 1.0
          },
          "medium_sum": {
            "value": 1.0
          }
        },
        {
          "key": "Hostname2",
          "doc_count": 1,
          "top_user_hits": {
            "hits": {
              "total": {
                "value": 1,
                "relation": "eq"
              },
              "max_score": 1.0,
              "hits": [
                {
                  "_index": "stof_64218649",
                  "_type": "_doc",
                  "_id": "2",
                  "_score": 1.0,
                  "_source": {
                    "high": 1,
                    "medium": 2
                  }
                }
              ]
            }
          },
          "high_sum": {
            "value": 1.0
          },
          "medium_sum": {
            "value": 2.0
          }
        },
        {
          "key": "Hostname3",
          "doc_count": 1,
          "top_user_hits": {
            "hits": {
              "total": {
                "value": 1,
                "relation": "eq"
              },
              "max_score": 1.0,
              "hits": [
                {
                  "_index": "stof_64218649",
                  "_type": "_doc",
                  "_id": "3",
                  "_score": 1.0,
                  "_source": {
                    "high": 2,
                    "medium": 2
                  }
                }
              ]
            }
          },
          "high_sum": {
            "value": 2.0
          },
          "medium_sum": {
            "value": 2.0
          }
        }
      ]
    }

Answer 2

我们可以使用这个查询来获得异常结果。

  {
          "query": {
            "bool": {
              "filter": [
                {
                  "bool": {
                    "should": [
                      {
                        "range": {
                          "medium": {
                            "gt": 0
                          }
                        }
                      },
                      {
                        "range": {
                          "high": {
                            "gt": 0
                          }
                        }
                      }
                    ]
                  }
                }
              ]
            }
          },
          "aggs": {
            "fieldnames": {
              "terms": {
                "field": "hostname.keyword"
              },
              "aggs": {
                "medium": {
                  "sum": {
                    "field": "medium"
                  }
                },
                "high": {
                  "sum": {
                    "field": "high"
                  }
                }
              }
            }
          },
          "size": 0
        }

搜索结果如下所示：

"aggregations": {
        "fieldnames": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
                {
                    "key": "ALL Unit",
                    "doc_count": 1,
                    "high": {
                        "value": 0.0
                    },
                    "medium": {
                        "value": 7.0
                    }
                },
                {
                    "key": "Latest Unit",
                    "doc_count": 1,
                    "high": {
                        "value": 0.0
                    },
                    "medium": {
                        "value": 5.0
                    }
                },
                {
                    "key": "NO Unit",
                    "doc_count": 1,
                    "high": {
                        "value": 1.0
                    },
                    "medium": {
                        "value": 1.0
                    }
                }
            ]
        }
    }

如果我们需要位置和应用程序的结果，只需将更改为Location

"aggs": {
                "fieldnames": {
                  "terms": {
                    "field": "businesshierarchy.Application.keyword"
                  }

for Application

"aggs": {
                    "fieldnames": {
                      "terms": {
                        "field": "businesshierarchy.Location.keyword"
                      }

如果地图是这样的，

{
  "mappings": {
    "properties": {
      "hostname": {
        "type": "keyword"
      },
      "businesshierarchy": {
        "properties": {
          "Location": {
            "type": "keyword"
          },
          "Application": {
            "type": "keyword"
          }
        }
      }
    }
  }
}

不需要添加.keyword到

"terms": {
             "field": "businesshierarchy.Location"
           }