Elasticsearch按嵌套字段分組

有沒有辦法通過嵌套字段進行分組並在非嵌套字段上執行聚合？Elasticsearch按嵌套字段分組

我有這樣的數據在ES

{ 
    "_index": "bighalf", 
    "_type": "excel", 
    "_id": "AVE0rgXqe0-x669Gsae3", 
    "_score": 1, 
    "_source": { 
     "Name": "Marsh", 
     "date": "2015-11-07T10:47:14", 
     "grade": 9, 
     "year": 2016, 
     "marks": 70, 
     "subject": "Mathematics", 
     "Gender": "male", 
     "dob": "22/11/2000", 
     "sprint": [ 
     { 
      "sprintdate": "2015-11-06T22:30:00", 
      "sprintname": "changed", 
      "sprintpoints": 52 
     } 
     ] 
    } 
    }, 
    { 
    "_index": "bighalf", 
    "_type": "excel", 
    "_id": "AVE0rvTHe0-x669Gsae5", 
    "_score": 1, 
    "_source": { 
     "Name": "Taylor", 
     "date": "2015-11-07T10:47:14", 
     "grade": 9, 
     "year": 2016, 
     "marks": 54, 
     "subject": "Mathematics", 
     "Gender": "male", 
     "dob": "22/11/2000", 
     "sprint": [ 
     { 
      "sprintdate": "2015-11-07T22:30:00", 
      "sprintname": "jira", 
      "sprintpoints": 52 
     } 
     ] 
    } 
    }

我想組由sprintname並找到marks

總和我想是這樣的：

SumBuilder sumGrades = AggregationBuilders.sum("sum_grade").field("grade"); 
NestedBuilder nested = AggregationBuilders.nested("nested").path("sprint") 
.subAggregation(AggregationBuilders.terms("by_sprint").field("sprint.sprintname").subAggregation(sumGrades)); 
String names[] = { "changed", "jira" }; 
QueryBuilder query = QueryBuilders.boolQuery().must(
QueryBuilders.nestedQuery("sprint",QueryBuilders.boolQuery().must(QueryBuilders.termsQuery("sprint.sprintname", names)))); 
FilterAggregationBuilder aggregation = AggregationBuilders.filter("agg").filter(query).subAggregation(nested);

的sum_grade沒有工作爲了我。但我改變字段（grade）與嵌套字段（sprintpoints），它的工作但我的要求是找到sum("grade")和組由sprint.sprintname。

來源

2015-12-14 ravi

你能分享'sprint'字段的映射嗎？ 'curl -XGET localhost：9200/bighalf/_mapping/excel/field/sprint' – Val

如果說localhost：9200/bighalf/_mapping/excel/field/sprint。我沒有得到任何映射。但如果我說http：// localhost：9200/bighalf/_mapping/excel。我正在獲取所有映射。 – ravi

{ 「衝刺」：{ 「類型」：「嵌套」，「屬性」：{ 「sprintdate」：{ 「類型」：「日期」，「格式」：「YYYY-MM-dd'T 「HH：MM：SS」 }，「sprintname」：{ 「類型」：「串」，「索引」：「not_analyzed」 }，「sprintpoints」：{ 「類型」：「長」 } } } } – ravi

由於您的sprint字段爲nested類型，因此在您的彙總中，您需要使用reverse_nested aggregation以便從嵌套區域內的根文檔「跳回」。它是這樣的：

SumBuilder sumGrades = AggregationBuilders.sum("sum_grade").field("grade"); 

ReverseNestedBuilder backToGrades = AggregationBuilders.reverseNested("spring_to_grade") 
    .subAggregation(sumGrades); 

TermsBuilder bySprint = AggregationBuilders.terms("by_sprint") 
    .field("sprint.sprintname").subAggregation(backToGrades) 

NestedBuilder nested = AggregationBuilders.nested("nested").path("sprint") 
    .subAggregation(bySprint); 

String names[] = { "changed", "jira" }; 
QueryBuilder query = QueryBuilders.boolQuery().must(
QueryBuilders.nestedQuery("sprint",QueryBuilders.boolQuery().must(QueryBuilders.termsQuery("sprint.sprintname", names)))); 
FilterAggregationBuilder aggregation = AggregationBuilders.filter("agg").filter(query).subAggregation(nested);

來源

2015-12-14 04:35:18 Val

你有這個機會嗎？ – Val

謝謝瓦爾。它幫助解決了這個問題。 – ravi

Elasticsearch按嵌套字段分組

回答

相關問題