Elasticsearch按嵌套字段分组

有没有办法通过嵌套字段进行分组并在非嵌套字段上执行聚合？Elasticsearch按嵌套字段分组

我有这样的数据在ES

{ 
    "_index": "bighalf", 
    "_type": "excel", 
    "_id": "AVE0rgXqe0-x669Gsae3", 
    "_score": 1, 
    "_source": { 
     "Name": "Marsh", 
     "date": "2015-11-07T10:47:14", 
     "grade": 9, 
     "year": 2016, 
     "marks": 70, 
     "subject": "Mathematics", 
     "Gender": "male", 
     "dob": "22/11/2000", 
     "sprint": [ 
     { 
      "sprintdate": "2015-11-06T22:30:00", 
      "sprintname": "changed", 
      "sprintpoints": 52 
     } 
     ] 
    } 
    }, 
    { 
    "_index": "bighalf", 
    "_type": "excel", 
    "_id": "AVE0rvTHe0-x669Gsae5", 
    "_score": 1, 
    "_source": { 
     "Name": "Taylor", 
     "date": "2015-11-07T10:47:14", 
     "grade": 9, 
     "year": 2016, 
     "marks": 54, 
     "subject": "Mathematics", 
     "Gender": "male", 
     "dob": "22/11/2000", 
     "sprint": [ 
     { 
      "sprintdate": "2015-11-07T22:30:00", 
      "sprintname": "jira", 
      "sprintpoints": 52 
     } 
     ] 
    } 
    }

我想组由sprintname并找到marks

总和我想是这样的：

SumBuilder sumGrades = AggregationBuilders.sum("sum_grade").field("grade"); 
NestedBuilder nested = AggregationBuilders.nested("nested").path("sprint") 
.subAggregation(AggregationBuilders.terms("by_sprint").field("sprint.sprintname").subAggregation(sumGrades)); 
String names[] = { "changed", "jira" }; 
QueryBuilder query = QueryBuilders.boolQuery().must(
QueryBuilders.nestedQuery("sprint",QueryBuilders.boolQuery().must(QueryBuilders.termsQuery("sprint.sprintname", names)))); 
FilterAggregationBuilder aggregation = AggregationBuilders.filter("agg").filter(query).subAggregation(nested);

的sum_grade没有工作为了我。但我改变字段（grade）与嵌套字段（sprintpoints），它的工作但我的要求是找到sum("grade")和组由sprint.sprintname。

来源

2015-12-14 ravi

你能分享'sprint'字段的映射吗？ 'curl -XGET localhost：9200/bighalf/_mapping/excel/field/sprint' – Val

如果说localhost：9200/bighalf/_mapping/excel/field/sprint。我没有得到任何映射。但如果我说http：// localhost：9200/bighalf/_mapping/excel。我正在获取所有映射。 – ravi

{ “冲刺”：{ “类型”： “嵌套”， “属性”：{ “sprintdate”：{ “类型”： “日期”， “格式”：“YYYY-MM-dd'T “HH：MM：SS” }， “sprintname”：{ “类型”： “串”， “索引”： “not_analyzed” }， “sprintpoints”：{ “类型”： “长” } } } } – ravi

由于您的sprint字段为nested类型，因此在您的汇总中，您需要使用reverse_nested aggregation以便从嵌套区域内的根文档“跳回”。它是这样的：

SumBuilder sumGrades = AggregationBuilders.sum("sum_grade").field("grade"); 

ReverseNestedBuilder backToGrades = AggregationBuilders.reverseNested("spring_to_grade") 
    .subAggregation(sumGrades); 

TermsBuilder bySprint = AggregationBuilders.terms("by_sprint") 
    .field("sprint.sprintname").subAggregation(backToGrades) 

NestedBuilder nested = AggregationBuilders.nested("nested").path("sprint") 
    .subAggregation(bySprint); 

String names[] = { "changed", "jira" }; 
QueryBuilder query = QueryBuilders.boolQuery().must(
QueryBuilders.nestedQuery("sprint",QueryBuilders.boolQuery().must(QueryBuilders.termsQuery("sprint.sprintname", names)))); 
FilterAggregationBuilder aggregation = AggregationBuilders.filter("agg").filter(query).subAggregation(nested);

来源

2015-12-14 04:35:18 Val

你有这个机会吗？ – Val

谢谢瓦尔。它帮助解决了这个问题。 – ravi

Elasticsearch按嵌套字段分组

回答

相关问题