ElasticSearch - Filter Buckets

有些话、适合烂在心里 提交于 2021-01-05 07:21:32

问题


My elasticSearch query is like:

{
    "size": 0,
    "aggs": {
        "group_by_id": {
            "terms": {
                "field": "Infos.InstanceInfo.ID.keyword",
                "size": 1000
            },
            "aggs": {
                "tops": {
                    "top_hits": {
                        "size": 100,
                        "sort": {
                            "Infos.InstanceInfo.StartTime": "asc"
                        }
                    }
                }
            }
        }
    }
}

It works fine, I have a result of this form:

aggregations
=========>group_by_id
==============>buckets
                {key:id1}
                ===============>docs
                {doc1.Status:"KO"}
                {doc2.Status:"KO"}
                
                {key:id2}
                ===============>docs
                {doc1.Status:"KO"}
                {doc2.Status:"OK"}
                
                {key:id3}
                ===============>docs
                {doc1.Status:"KO"}
                {doc2.Status:"OK"}

I'm trying to add a filter, so when "OK" the result must be like this:

aggregations
=========>group_by_id
==============>buckets
                {key:id2}
                ===============>docs
                {doc1.Status:"KO"}
                {doc2.Status:"OK"}
                
                {key:id3}
                ===============>docs
                {doc1.Status:"KO"}
                {doc2.Status:"OK"}

and for "KO" :

aggregations
=========>group_by_id
==============>buckets
                {key:id1}
                ===============>docs
                {doc1.Status:"KO"}
                {doc2.Status:"KO"}

Fields "Startime" & "Status" are at the same level "Infos.InstanceInfo.[...]" Any idea?

EDIT

Sample docs:

{
  "took" : 794,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "group_by_id" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 143846,
      "buckets" : [
        {
          "key" : "1000",
          "doc_count" : 6,
          "tops" : {
            "hits" : {
              "total" : {
                "value" : 6,
                "relation" : "eq"
              },
              "max_score" : null,
              "hits" : [
                {
                  "_index" : "azerty",
                  "_type" : "_doc",
                  "_id" : "vHFvoXYBVWrYChNi7hB7",
                  "_score" : null,
                  "_source" : {
                    "Infos" : {
                      "InstanceInfo" : {
                        "ID" : "1000",
                        "StartTime" : "2020-12-27T00:43:56.011+01:00",
                        "status" : "KO"
                      }
                    }
                  },
                  "sort" : [
                    1609026236011
                  ]
                },
                {
                  "_index" : "azerty",
                  "_type" : "_doc",
                  "_id" : "xHFvoXYBVWrYChNi7xAB",
                  "_score" : null,
                  "_source" : {
                    "Infos" : {
                      "InstanceInfo" : {
                        "ID" : "1000",
                        "StartTime" : "2020-12-27T00:43:56.145+01:00",
                        "status" : "OK"
                      }
                    }
                  },
                  "sort" : [
                    1609026236145
                  ]
                },
                {
                  "_index" : "azerty",
                  "_type" : "_doc",
                  "_id" : "xXFvoXYBVWrYChNi7xAC",
                  "_score" : null,
                  "_source" : {
                    "Infos" : {
                      "InstanceInfo" : {
                        "ID" : "1000",
                        "StartTime" : "2020-12-27T00:43:56.147+01:00",
                        "status" : "OK"
                      }
                    }
                  },
                  "sort" : [
                    1609026236147
                  ]
                },
                {
                  "_index" : "azerty",
                  "_type" : "_doc",
                  "_id" : "x3FvoXYBVWrYChNi7xAs",
                  "_score" : null,
                  "_source" : {
                    "Infos" : {
                      "InstanceInfo" : {
                        "ID" : "1000",
                        "StartTime" : "2020-12-27T00:43:56.188+01:00",
                        "status" : "OK"
                      }
                    }
                  },
                  "sort" : [
                    1609026236188
                  ]
                },
                {
                  "_index" : "azerty",
                  "_type" : "_doc",
                  "_id" : "yHFvoXYBVWrYChNi7xAs",
                  "_score" : null,
                  "_source" : {
                    "Infos" : {
                      "InstanceInfo" : {
                        "ID" : "1000",
                        "StartTime" : "2020-12-27T00:43:56.19+01:00",
                        "status" : "OK"
                      }
                    }
                  },
                  "sort" : [
                    1609026236190
                  ]
                },
                {
                  "_index" : "azerty",
                  "_type" : "_doc",
                  "_id" : "ynFvoXYBVWrYChNi7xBd",
                  "_score" : null,
                  "_source" : {
                    "Infos" : {
                      "InstanceInfo" : {
                        "ID" : "1000",
                        "StartTime" : "2020-12-27T00:43:56.236+01:00",
                        "status" : "OK"
                      }
                    }
                  },
                  "sort" : [
                    1609026236236
                  ]
                }
              ]
            }
          }
        },
        {
          "key" : "2000",
          "doc_count" : 2,
          "tops" : {
            "hits" : {
              "total" : {
                "value" : 2,
                "relation" : "eq"
              },
              "max_score" : null,
              "hits" : [
                {
                  "_index" : "azerty",
                  "_type" : "_doc",
                  "_id" : "7HL_onYBVWrYChNij4Is",
                  "_score" : null,
                  "_source" : {
                    "Infos" : {
                      "InstanceInfo" : {
                        "ID" : "2000",
                        "StartTime" : "2020-12-27T08:00:26.011+01:00",
                        "status" : "KO"
                      }
                    }
                  },
                  "sort" : [
                    1609052426011
                  ]
                },
                {
                  "_index" : "azerty",
                  "_type" : "_doc",
                  "_id" : "9HL_onYBVWrYChNij4Kz",
                  "_score" : null,
                  "_source" : {
                    "Infos" : {
                      "InstanceInfo" : {
                        "ID" : "2000",
                        "StartTime" : "2020-12-27T08:00:26.146+01:00",
                        "status" : "KO"
                      }
                    }
                  },
                  "sort" : [
                    1609052426146
                  ]
                }
              ]
            }
          }
        },
        {
          "key" : "3000",
          "doc_count" : 6,
          "tops" : {
            "hits" : {
              "total" : {
                "value" : 6,
                "relation" : "eq"
              },
              "max_score" : null,
              "hits" : [
                {
                  "_index" : "azerty",
                  "_type" : "_doc",
                  "_id" : "7nNRpHYBVWrYChNiiruh",
                  "_score" : null,
                  "_source" : {
                    "Infos" : {
                      "InstanceInfo" : {
                        "ID" : "3000",
                        "StartTime" : "2020-12-27T14:09:36.015+01:00",
                        "status" : "KO"
                      }
                    }
                  },
                  "sort" : [
                    1609074576015
                  ]
                },
                {
                  "_index" : "azerty",
                  "_type" : "_doc",
                  "_id" : "9nNRpHYBVWrYChNii7s5",
                  "_score" : null,
                  "_source" : {
                    "Infos" : {
                      "InstanceInfo" : {
                        "ID" : "3000",
                        "StartTime" : "2020-12-27T14:09:36.166+01:00",
                        "status" : "OK"
                      }
                    }
                  },
                  "sort" : [
                    1609074576166
                  ]
                },
                {
                  "_index" : "azerty",
                  "_type" : "_doc",
                  "_id" : "93NRpHYBVWrYChNii7s5",
                  "_score" : null,
                  "_source" : {
                    "Infos" : {
                      "InstanceInfo" : {
                        "ID" : "3000",
                        "StartTime" : "2020-12-27T14:09:36.166+01:00",
                        "status" : "OK"
                      }
                    }
                  },
                  "sort" : [
                    1609074576166
                  ]
                },
                {
                  "_index" : "azerty",
                  "_type" : "_doc",
                  "_id" : "-XNRpHYBVWrYChNii7ti",
                  "_score" : null,
                  "_source" : {
                    "Infos" : {
                      "InstanceInfo" : {
                        "ID" : "3000",
                        "StartTime" : "2020-12-27T14:09:36.209+01:00",
                        "status" : "OK"
                      }
                    }
                  },
                  "sort" : [
                    1609074576209
                  ]
                },
                {
                  "_index" : "azerty",
                  "_type" : "_doc",
                  "_id" : "-nNRpHYBVWrYChNii7ts",
                  "_score" : null,
                  "_source" : {
                    "Infos" : {
                      "InstanceInfo" : {
                        "ID" : "3000",
                        "StartTime" : "2020-12-27T14:09:36.219+01:00",
                        "status" : "OK"
                      }
                    }
                  },
                  "sort" : [
                    1609074576219
                  ]
                },
                {
                  "_index" : "azerty",
                  "_type" : "_doc",
                  "_id" : "_HNRpHYBVWrYChNii7ud",
                  "_score" : null,
                  "_source" : {
                    "Infos" : {
                      "InstanceInfo" : {
                        "ID" : "3000",
                        "StartTime" : "2020-12-27T14:09:36.269+01:00",
                        "status" : "OK"
                      }
                    }
                  },
                  "sort" : [
                    1609074576269
                  ]
                }
              ]
            }
          }
        }
      ]
    }
  }
}

回答1:


Assuming the status field is under Infos.InstanceInfo and it's of the keyword mapping, you can utilize the filter aggregation:

{
  "size": 0,
  "aggs": {
    "status_KO_only": {
      "filter": {                                  <--
        "term": {
          "Infos.InstanceInfo.Status": "KO"
        }
      },
      "aggs": {
        "group_by_id": {
          "terms": {
            "field": "Infos.InstanceInfo.ID.keyword",
            "size": 1000
          },
          "aggs": {
            "tops": {
              "top_hits": {
                "size": 100,
                "sort": {
                  "Infos.InstanceInfo.StartTime": "asc"
                }
              }
            }
          }
        }
      }
    }
  }
}

In this particular case you could've applied the same term query in the query part of the search request without having to use a filter aggregation.


If you want to get both OK and KO in the same request, you can copy/paste the whole status_KO_only aggregation, rename the 2nd one, and voila -- you now have both groups in one request. You can of course have as many differently named (top-level) filter aggs as you like.

Now, when you indeed need multiple filter aggs at once, there's a more elegant way that does not require copy-pasting -- enter the filters aggregation:

{
  "size": 0,
  "aggs": {
    "by_statuses": {
      "filters": {                                     <--
        "filters": {
          "status_KO": {
            "term": {
              "Infos.InstanceInfo.Status": "KO"
            }
          },
          "status_OK": {
            "term": {
              "Infos.InstanceInfo.Status": "OK"
            }
          }
        }
      },
      "aggs": {
        "group_by_id": {
          "terms": {
            "field": "Infos.InstanceInfo.ID.keyword",
            "size": 1000
          },
          "aggs": {
            "tops": {
              "top_hits": {
                "size": 100,
                "sort": {
                  "Infos.InstanceInfo.StartTime": "asc"
                }
              }
            }
          }
        }
      }
    }
  }
}

Any of the child sub-aggregations will automatically be the buckets of the explicitly declared term filters.

I personally find the copy/paste approach more readable, esp. when constructing such requests dynamically (based on UI dropdowns and such.)



来源:https://stackoverflow.com/questions/65449336/elasticsearch-filter-buckets

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!