elasticsearch - 在Elastic Search 2.3中聚合后如何选择字段

我有以下索引架构:

 PUT
    "mappings": {
        "event": {
          "properties": {
            "@timestamp": { "type": "date",    "doc_values": true},
            "partner_id":  { "type": "integer", "doc_values": true},
            "event_id": { "type": "integer", "doc_values": true},
            "count": { "type": "integer", "doc_values": true, "index": "no" },
            "device_id": { "type": "string", "index":"not_analyzed","doc_values":true }
            "product_id": { "type": "integer", "doc_values": true},
          }
        }
      }

我需要等于以下查询的结果:

SELECT product_id, device_id, sum(count) FROM index WHERE partner_id=5 AND timestamp<=end_date AND timestamp>=start_date GROUP BY device_id,product_id having sum(count)>1;

我可以通过以下 flex 查询来实现结果:

GET
{
    "store": true,
    "size":0,
    "aggs":{
        "matching_events":{
            "filter":{
                "bool":{
                    "must":[
                        {
                            "term":{
                                "partner_id":5
                            }
                        },
                        {
                            "range":{
                                "@timestamp":{
                                    "from":1470904000,
                                    "to":1470904999
                                }
                            }
                        }
                    ]
                }
            },
            "aggs":{
                      "group_by_productid": {
                      "terms":{
                        "field":"product_id"
                    },
            "aggs":{
                "group_by_device_id":{
                    "terms":{
                        "field":"device_id"
                    },
                    "aggs":{
                        "total_count":{
                            "sum":{
                                "field":"count"
                            }
                        },
                        "sales_bucket_filter":{
                            "bucket_selector":{
                                "buckets_path":{
                                    "totalCount":"total_count"
                                },
                                "script": {"inline": "totalCount > 1"}
                            }
                        }
                    }
                    }}
                }
            }
        }
    }

}'

但是，对于count is <=1查询返回键为product_id的空存储桶的情况。现在，在四千万个小组中，只有十万个小组可以满足该条件，因此我返回的结果非常丰富，其中大部分是无用的。汇总后如何仅选择特定字段？我尝试了此方法，但不起作用-`“fields”:[“aggregations.matching_events.group_by_productid.group_by_device_id.buckets.key”]

编辑:

我有以下数据集:

 device id                       Partner Id         Count
db63te2bd38672921ffw27t82        367                   3
db63te2bd38672921ffw27t82        272                   1

我去这个输出:-

{

    "took":6,
    "timed_out":false,
    "_shards":{
        "total":5,
        "successful":5,
        "failed":0
    },
    "hits":{
        "total":7,
        "max_score":0.0,
        "hits":[
        ]
    },
    "aggregations":{
        "matching_events":{
            "doc_count":5,
            "group_by_productid":{
                "doc_count_error_upper_bound":0,
                "sum_other_doc_count":0,
                "buckets":[
                    {
                        "key":367,
                        "doc_count":3,
                        "group_by_device_id":{
                            "doc_count_error_upper_bound":0,
                            "sum_other_doc_count":0,
                            "buckets":[
                                {
                                    "key":"db63te2bd38672921ffw27t82",
                                    "doc_count":3,
                                    "total_count":{
                                        "value":3.0
                                    }
                                }
                            ]
                        }
                    },
                    {
                        "key":272,
                        "doc_count":1,
                        "group_by_device_id":{
                            "doc_count_error_upper_bound":0,
                            "sum_other_doc_count":0,
                            "buckets":[
                            ]
                        }
                    }
                ]
            }
        }
    }

}

如您所见，键272的存储桶为空，这是有道理的，但是否不应该将整个存储桶从结果集中删除？

最佳答案

我刚刚发现，存在一个相当近期的问题，PR在_bucket_count选项中添加了buckets_path路径，以便聚合可以根据另一个聚合具有的存储桶数来过滤父存储桶。换句话说，如果父_bucket_count的bucket_selector为0，则应删除存储桶。

这是github问题:https://github.com/elastic/elasticsearch/issues/19553

关于elasticsearch - 在Elastic Search 2.3中聚合后如何选择字段，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/38910138/