Elasticsearch术语聚合未返回任何存储桶

Question

此处为elasticsearch新用户，但存在术语聚合问题。我为187份文档编制了索引，其中包含“名称”、“主机”、“风险”等字段。字段风险有4个唯一值（“关键”、“高”、“中”、“低”、“信息”），我正在运行这样的术语聚合：

POST http://localhost:9200/{index_name}/_search?size=0

{
    "aggs":{
        "riskCount":{
            "terms":{ 
                "field":"risk.keyword"
                }
        }
    }
}

我希望得到一个结果，说明我有x个临界值，x个高值等等。问题是，我没有得到返回的桶。

{
    "took": 2,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 187,
            "relation": "eq"
        },
        "max_score": null,
        "hits": []
    },
    "aggregations": {
        "riskCount": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": []
        }
    }
}

我的Elasticsearch版本是7.12.0有什么想法吗

>

编辑：这是映射：

"findings": {
     "mappings": {
         "properties": {
             "date_uploaded": {
                 "type": "date"
             },
             "host": {
                 "type": "text"
             },
             "name": {
                 "type": "text"
             },
             "risk": {
                 "type": "text"
             }
         }
     }
 }

以下是文件：

{
    "took": 1,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 187,
            "relation": "eq"
        },
        "max_score": 1.0,
        "hits": [
            {
                "_index": "findings",
                "_type": "_doc",
                "_id": "f86b6b5b-f09e-4350-9a66-d88a3a78f640",
                "_score": 1.0,
                "_source": {
                    "risk": "Informational",
                    "name": "HTTP Server Type and Version",
                    "host": "10.10.9.10",
                    "date_uploaded": "2021-05-07T19:39:10.810663+00:00"
                }
            }
        ]
    }
}

Answer 1

您没有任何风险。映射中的关键字字段。您需要如下更改映射。只需运行以下命令来更新映射并创建风险。关键字子字段：

PUT index-name/_mapping
{
      "properties": {
        "date_uploaded": {
          "type": "date"
        },
        "host": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword"
            }
          }
        },
        "name": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword"
            }
          }
        },
        "risk": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword"
            }
          }
        }
      }
}

然后使用以下命令重新索引您的数据：

POST index-name/_update_by_query

然后可以按如下方式运行查询：

{
    "aggs":{
        "riskCount":{
            "terms":{ 
                "field":"risk.keyword"
            }
        }
    }
}

Answer 2

由于风险字段是text类型，因此您需要将索引映射更新为

PUT /_mapping
{
  "properties": {
    "risk": {
      "type": "text",
      "fields": {
        "keyword": {
          "type": "keyword"
        }
      }
    }
  }
}

然后运行update\u by\u查询API来重新索引数据