獲取使用ElasticSearch聚集全文件

Question

我有喜歡的指標：

[ 
    { 
     "Name": "Alex", 
     "LastName": "Ich", 
     "Department": 2 
    }, 
    { 
     "Name": "Charlie", 
     "LastName": "Sheen", 
     "Department": 3 
    }, 
    { 
     "Name": "Peter", 
     "LastName": "Petrelli", 
     "Department": 5 
    }, 
    { 
     "Name": "Alan", 
     "LastName": "Harper", 
     "Department": 6 
    }, 
    { 
     "Name": "Ann", 
     "LastName": "Bottle", 
     "Department": 3 
    }, 
] 

而且我想用不同的Department的結果，我不關心順序，每Department僅有1分的結果。我試着用聚合但我只能管理相關聯的doc_count得到不同Deppartments。他們詢問我想是這樣的：

{ 
    "aggs": { 
    "deppartments": { 
     "terms": { 
     "field": "Department" 
     } 
    } 
    },"size": 0 
} 

它返回：

"buckets": [ 
    { 
     "key": 2, 
     "doc_count": 1 
    }, 
    { 
     "key": 3, 
     "doc_count": 2 
    }, 
    { 
     "key": 5, 
     "doc_count": 1 
    }, 
    { 
     "key": 6, 
     "doc_count": 1 
    }, 
] 

當我想是這樣的：

[ 
    { 
     "Name": "Alex", 
     "LastName": "Ich", 
     "Department": 2 
    }, 
    { 
     "Name": "Charlie", 
     "LastName": "Sheen", 
     "Department": 3 
    }, 
    { 
     "Name": "Peter", 
     "LastName": "Petrelli", 
     "Department": 5 
    }, 
    { 
     "Name": "Alan", 
     "LastName": "Harper", 
     "Department": 6 
    } 
] 

Answer 1

您可以使用Top hits aggregation這個

{ 
    "aggs": { 
    "departments": { 
     "terms": { 
     "field": "Department", 
     "size": 10 
     }, 
     "aggs": { 
     "search_results": { 
      "top_hits": { 
      "size": 10 <--- you can change the size to 1 if you want 
      } 
     } 
     } 
    } 
    }, 
    "size": 0 
} 

這有幫助嗎？