Elasticsearch字段上的总和和计数聚合

Question

我是Elasticsearch的新手，我希望在Elasticsearch 5的字段上执行某些聚合。x索引。我有一个索引，其中包含带有字段（具有嵌套结构）和字段（具有嵌套结构）的文档。这些是动态映射的字段。以下是示例文档

{
   "_index":"A",
   "_type":"document",
   "_id":"1",
   "_source":{
      "text":"This is a test sentence.",
      "langs":{
         "X":{
            "en":1,
            "es":2,
            "zh":3
         },
        "Y":{
            "en":4,
            "es":5,
            "zh":6
         } 
      },
      "docLang": "en"
   }
}

文件2：

{
   "_index":"A",
   "_type":"document",
   "_id":"2",
   "_source":{
      "text":"This is a test sentence.",
      "langs":{
         "X":{
            "en":1,
            "es":2
         },
         "Y":{
            "en":3,
            "es":4
         } 
      },
      "docLang": "es"
   }
}

DOC 3：

{
   "_index":"A",
   "_type":"document",
   "_id":"2",
   "_source":{
      "text":"This is a test sentence.",
      "langs":{
         "X":{
            "en":1
         },
         "Y":{
            "en":2
         } 
      },
      "docLang": "en"
   }
}

我想在langs字段上执行总和聚合，这样对于每个键（X/Y）和每种语言，我都可以获得索引中所有文档的总和。此外，我还想从docLang字段生成每种语言类型的文档数。

e、 g.：对于以上3个文档，langs字段上的总和聚合如下所示：

"langs":{  
      "X":{  
         "en":3,
         "es":4,
         "zh":3
      },
      "Y":{  
         "en":9,
         "es":9,
         "zh":6
      }
   }

docLang计数如下所示：

 "docLang":{
    "en" : 2,
    "es" : 1
   }

此外，由于一些生产环境限制，我无法在Elasticsearch中使用脚本。所以，我想知道是否可以对上述字段使用聚合类型？

Answer 1

{
  "size": 0,
  "aggs": {
    "X": {
      "nested": {
        "path": "langs.X"
      },
      "aggs": {
        "X_sum_en": {
          "sum": {
            "field": "langs.X.en"
          }
        },
        "X_sum_es": {
          "sum": {
            "field": "langs.X.es"
          }
        },
        "X_sum_zh": {
          "sum": {
            "field": "langs.X.zh"
          }
        }
      }
    },
    "Y": {
      "nested": {
        "path": "langs.Y"
      },
      "aggs": {
        "Y_sum_en": {
          "sum": {
            "field": "langs.Y.en"
          }
        },
        "Y_sum_es": {
          "sum": {
            "field": "langs.Y.es"
          }
        },
        "Y_sum_zh": {
          "sum": {
            "field": "langs.Y.zh"
          }
        }
      }
    },
    "sum_docLang": {
      "terms": {
        "field": "docLang.keyword",
        "size": 10
      }
    }
  }
}

既然你没有提到，但我认为这很重要。我将X和Y作为嵌套字段：

    "langs": {
      "properties": {
        "X": {
          "type": "nested",
          "properties": {
            "en": {
              "type": "long"
            },
            "es": {
              "type": "long"
            },
            "zh": {
              "type": "long"
            }
          }
        },
        "Y": {
          "type": "nested",
          "properties": {
            "en": {
              "type": "long"
            },
            "es": {
              "type": "long"
            },
            "zh": {
              "type": "long"
            }
          }
        }
      }
    }

但是，如果字段根本不是嵌套的，这里我指的是Elasticsearch中的嵌套字段类型，那么像这样的简单聚合就足够了：

{
  "size": 0,
  "aggs": {
    "X_sum_en": {
      "sum": {
        "field": "langs.X.en"
      }
    },
    "X_sum_es": {
      "sum": {
        "field": "langs.X.es"
      }
    },
    "X_sum_zh": {
      "sum": {
        "field": "langs.X.zh"
      }
    },
    "Y_sum_en": {
      "sum": {
        "field": "langs.Y.en"
      }
    },
    "Y_sum_es": {
      "sum": {
        "field": "langs.Y.es"
      }
    },
    "Y_sum_zh": {
      "sum": {
        "field": "langs.Y.zh"
      }
    },
    "sum_docLang": {
      "terms": {
        "field": "docLang.keyword",
        "size": 10
      }
    }
  }
}