如何在彈性搜索中獲得另一列的聚合

Question

我想根據column1對記錄進行分組。 對於每個組，我想要一個具有最大值column2的記錄。 除了column1，max（column2），我還希望每個組的column3的column2的值與max（column2）匹配。

如何爲此查詢？

我能夠得到前兩點，但沒有找到獲得另一列的方式。

{ 
    "size": 0, 
    "aggs": { 
    "group": { 
     "terms": { 
     "field": "column1" 
     }, 
     "aggs": { 
     "column2": { 
      "max": { 
      "field": "column2" 
      } 
     } 
     } 
    } 
    } 
} 

它給像

{ 

    "took": 25, 
    "timed_out": false, 
    "_shards": { 
     "total": 5, 
     "successful": 5, 
     "failed": 0 
    }, 
    "hits": { 
     "total": 3995, 
     "max_score": 0, 
     "hits": [ ] 
    }, 
    "aggregations": { 
     "group": { 
      "doc_count_error_upper_bound": 12, 
      "sum_other_doc_count": 3776, 
      "buckets": [ 
       { 
        "key": 10, 
        "doc_count": 27, 
        "column2": { 
         "value": 20110930013248 
        } 
       } 
       , 
       { 
        "key": 711, 
        "doc_count": 23, 
        "column2": { 
         "value": 20111013174812 
        } 
       } 
       , 
       { 
        "key": 888, 
        "doc_count": 22, 
        "column2": { 
         "value": 20110531204116 
        } 
       } 
       , 
       { 
        "key": 907, 
        "doc_count": 22, 
        "column2": { 
         "value": 20111013175931 
        } 
       } 
       , 
       { 
        "key": 1098, 
        "doc_count": 22, 
        "column2": { 
         "value": 20110421183543 
        } 
       } 
       , 
       { 
        "key": 702, 
        "doc_count": 21, 
        "column2": { 
         "value": 20111011183045 
        } 
       } 
       , 
       { 
        "key": 878, 
        "doc_count": 21, 
        "column2": { 
         "value": 20110713195140 
        } 
       } 
       , 
       { 
        "key": 973, 
        "doc_count": 21, 
        "column2": { 
         "value": 20111007203050 
        } 
       } 
       , 
       { 
        "key": 29, 
        "doc_count": 20, 
        "column2": { 
         "value": 20110927163219 
        } 
       } 
       , 
       { 
        "key": 675, 
        "doc_count": 20, 
        "column2": { 
         "value": 201110070
        } 
       } 
      ] 
     } 
    } 

} 

我想也是這個結果JSON欄3的值輸出。

Answer 1

我覺得下面的查詢工作，你的情況：

{ 
"size": 0, 
"aggs": { 
"group": { 
    "terms": { 
    "field": "column1" 
    }, 
    "aggs": { 
    "column2": { 
     "top_hits": { 
     "fields": ["column2" , "column3"], 
     "sort" : { 
      "column2" : "desc"     ===> Sorting with column2 in decsreasing order to get max on top 
     }, 
     "size" : 1     ===> Restricting to size 1, so that only highest is returned 
     } 
     } 
     } 
    } 
    } 
} 

希望這有助於！