在elasticsearch中，如何在嵌套数组中按值分组

Question

我有以下文件：

第一份文件：

{
  productName: "product1",
  tags: [
    {
      "name":"key1",
      "value":"value1"
    },
    {
      "name":"key2",
      "value":"value2"
    }
  ]
}

第二份文件：

{
  productName: "product2",
  tags: [
    {
      "name":"key1",
      "value":"value1"
    },
    {
      "name":"key2",
      "value":"value3"
    }
  ]
}

我知道如果我想按产品名称分组，我可以使用terms聚合

"terms": {
    "field": "productName"
}

这将给我两个桶，两个不同的键“product1”，“product2”。

但是，如果我想按标记键分组，查询应该是什么？i、 e.我想按name==key1的标记分组，然后我希望有一个key=“value1”的bucket；而如果我按name==key2的标记分组，我希望结果是两个bucket，其键为“value2”、“value3”。

如果我想在嵌套数组中按“值”分组，而不是按“键”分组，那么查询应该是什么样子？有什么建议吗？

Answer 1

听起来，您需要的是嵌套术语聚合。

对于您发布的两个文档，此查询：

POST /test_index/_search
{
   "size": 0,
   "aggs": {
      "product_name_terms": {
         "terms": {
            "field": "product_name"
         }
      },
      "nested_tags": {
         "nested": {
            "path": "tags"
         },
         "aggs": {
            "tags_name_terms": {
               "terms": {
                  "field": "tags.name"
               }
            },
            "tags_value_terms": {
               "terms": {
                  "field": "tags.value"
               }
            }
         }
      }
   }
}

返回以下内容：

{
   "took": 67,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 2,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "product_name_terms": {
         "doc_count_error_upper_bound": 0,
         "sum_other_doc_count": 0,
         "buckets": []
      },
      "nested_tags": {
         "doc_count": 4,
         "tags_name_terms": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
               {
                  "key": "key1",
                  "doc_count": 2
               },
               {
                  "key": "key2",
                  "doc_count": 2
               }
            ]
         },
         "tags_value_terms": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
               {
                  "key": "value1",
                  "doc_count": 2
               },
               {
                  "key": "value2",
                  "doc_count": 1
               },
               {
                  "key": "value3",
                  "doc_count": 1
               }
            ]
         }
      }
   }
}

下面是我用来测试它的一些代码：

http://sense.qbox.io/gist/a9a172f41dbd520d5e61063a9686055681110522

编辑：按嵌套值筛选

根据您的评论，如果您想通过（嵌套结果的）值过滤嵌套结果，您可以使用过滤器聚合添加另一个“层”聚合，如下所示：

POST /test_index/_search
{
   "size": 0,
   "aggs": {
      "nested_tags": {
         "nested": {
            "path": "tags"
         },
         "aggs": {
            "filter_tag_name": {
               "filter": {
                  "term": {
                     "tags.name": "key1"
                  }
               },
               "aggs": {
                  "tags_name_terms": {
                     "terms": {
                        "field": "tags.name"
                     }
                  },
                  "tags_value_terms": {
                     "terms": {
                        "field": "tags.value"
                     }
                  }
               }
            }
         }
      }
   }
}

返回：

{
   "took": 10,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 2,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "nested_tags": {
         "doc_count": 4,
         "filter_tag_name": {
            "doc_count": 2,
            "tags_name_terms": {
               "doc_count_error_upper_bound": 0,
               "sum_other_doc_count": 0,
               "buckets": [
                  {
                     "key": "key1",
                     "doc_count": 2
                  }
               ]
            },
            "tags_value_terms": {
               "doc_count_error_upper_bound": 0,
               "sum_other_doc_count": 0,
               "buckets": [
                  {
                     "key": "value1",
                     "doc_count": 2
                  }
               ]
            }
         }
      }
   }
}

以下是更新的代码：

http://sense.qbox.io/gist/507c3aabf36b8f6ed8bb076c8c1b8552097c5458