Elasticsearch聚合查询中的嵌套过滤器

Question

我正在使用嵌套筛选器运行以下聚合查询

GET <indexname>/_search
{
  "aggs": {
    "NAME": {
      "nested": {
        "path": "crm.LeadStatusHistory"
      },
      "aggs": {
        "agg_filter": {
          "filter": {
            "bool": {
              "must": [
                {
                  "nested": {
                    "path": "crm",
                    "query": {
                      "terms": {
                        "crm.City.keyword": [
                          "Rewa"
                        ]
                      }
                    }
                  }
                },
                {
                  "nested": {
                    "path": "crm",
                    "query": {
                      "terms": {
                        "crm.LeadID": [
                          27961
                        ]
                      }
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "agg_terms":{
              "terms": {
                "field": "crm.LeadStatusHistory.StatusID",
                "size": 1000
              }
            }
          }
        }
      }
    }
  }
}

->我有以下文档

{
        "_index" : "crm",
        "_type" : "_doc",
        "_id" : "4478",
        "_score" : 1.0,
        "_source" : {
          "crm" : [
            {
              "LeadStatusHistory" : [
                {
                  "StatusID" : 3
                },
                {
                  "StatusID" : 2
                },
                {
                  "StatusID" : 1
                }
              ],
              "LeadID" : 27961,
              "City" : "Rewa"
            },
            {
              "LeadStatusHistory" : [
                {
                  "StatusID" : 1
                },
                {
                  "StatusID" : 3
                },
                {
                  "StatusID" : 2
                }
              ],
              "LeadID" : 27959,
              "City" : "Rewa"
            }
          ]
        }
      }]

然而，作为回应，我得到了以下结果

"aggregations" : {
    "NAME" : {
      "doc_count" : 4332,
      "agg_filter" : {
        "doc_count" : 1,
        "agg_terms" : {
          "doc_count_error_upper_bound" : 0,
          "sum_other_doc_count" : 0,
          "buckets" : [
            {
              "key" : 1,
              "doc_count" : 1
            }
          ]
        }
      }
    }
  }

Query===>根据源文档，我有3个嵌套的'crm.LeadStatusHistory‘文档，crm.LeadID = 27961。但是，结果显示agg_filter等于1而不是3。您能告诉我这种情况的原因吗？

Answer 1

您的agg_filter在crm.LeadStatusHistory上，=>将只针对1个文档(LeadStatusHistory是一个文档，在您的情况下是指向其他文档的链接)。

我建立了一个显示这一点的查询，我想我会回答你的问题。您将看到每个聚合的不同doc_count。

{
  "size": 0,
  "aggs": {
    "NAME": {
      "nested": {
        "path": "crm"
      },
      "aggs": {
        "agg_LeadID": {
          "terms": {
            "field": "crm.LeadID"
          },
          "aggs": {
            "agg_LeadStatusHistory": {
              "nested": {
                "path": "crm.LeadStatusHistory"
              },
              "aggs": {
                "home_type_name": {
                  "terms": {
                    "field": "crm.LeadStatusHistory.StatusID"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

使用这个脚本，您可以计算它们的数量(如果需要，还可以进行过滤)：

{
  "size": 0,
  "aggs": {
    "NAME": {
      "nested": {
        "path": "crm"
      },
      "aggs": {
        "agg_LeadID": {
          "terms": {
            "field": "crm.LeadID"
          },
          "aggs": {
            "agg_LeadStatusHistory": {
              "nested": {
                "path": "crm.LeadStatusHistory"
              },
              "aggs": {
                "agg_LeadStatusHistory_sum": {
                  "sum": {
                    "script": "doc['crm.LeadStatusHistory.StatusID'].values.length"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

注意:如果想要获取嵌套文档的数量，请查看inner_hits：https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-body.html#request-body-search-inner-hits

Answer 2

我不同意'crm.LeadStatusHistory‘中的回答是一个文档。我已经在没有过滤器的crm.LeadstatusHistory上运行了聚合查询。

GET crm/_search
{
  "_source": ["crm.LeadID","crm.LeadStatusHistory.StatusID","crm.City"], 
  "size": 10000,
  "query": {
    "nested": {
      "path": "crm",
      "query": {
        "match": {
          "crm.LeadID": "27961"
        }
      }
    }
  }, 
  "aggs": {
    "agg_statuscount": {
      "nested": {
        "path": "crm.LeadStatusHistory"
      },
          "aggs": {
            "agg_terms":{
              "terms": {
                "field": "crm.LeadStatusHistory.StatusID",
                "size": 1000
              }
            }
          }
        }
      }
    }

我从上面的查询中得到了以下响应，它将'agg_statuscount‘显示为6个不带过滤器的文档

{
  "took" : 6,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "crm",
        "_type" : "_doc",
        "_id" : "4478",
        "_score" : 1.0,
        "_source" : {
          "crm" : [
            {
              "LeadStatusHistory" : [
                {
                  "StatusID" : 3
                },
                {
                  "StatusID" : 2
                },
                {
                  "StatusID" : 1
                }
              ],
              "LeadID" : 27961,
              "City" : "Rewa"
            },
            {
              "LeadStatusHistory" : [
                {
                  "StatusID" : 1
                },
                {
                  "StatusID" : 3
                },
                {
                  "StatusID" : 2
                }
              ],
              "LeadID" : 27959,
              "City" : "Rewa"
            }
          ]
        }
      }
    ]
  },
  "aggregations" : {
    "agg_statuscount" : {
      "doc_count" : 6,
      "agg_terms" : {
        "doc_count_error_upper_bound" : 0,
        "sum_other_doc_count" : 0,
        "buckets" : [
          {
            "key" : 1,
            "doc_count" : 2
          },
          {
            "key" : 2,
            "doc_count" : 2
          },
          {
            "key" : 3,
            "doc_count" : 2
          }
        ]
      }
    }
  }
}

因此，当聚合筛选器中的crm.LeadID = 27961时，我期望有3个'crm.LeadStatusHistory‘文档。目前的回答是1，和我最初的问题一样。