elasticsearch - ElasticSearch嵌套过滤器和聚合

所以我有这个映射:

"employee": {
  "properties": {
     "DaysOff": {
        "type": "nested",
        "properties": {
           "Date": {
              "type": "date",
              "format": "strict_date_optional_time||epoch_millis"
           },
           "Days": {
              "type": "double"
           },
           "ID": {
              "type": "long"
           }
        }
     }
  }
}

因此，基本上，员工可以请假。他们每天休息的时间都存储在DaysOff属性下的数组中。 Days可以是一天的一小部分，因此，如果一名雇员请假半天，则为0.5。

所以我有这个搜索:

{
   "size": 45,
   "filter": {
      "nested": {
         "path": "DaysOff",
         "filter": {
            "range": {
               "DaysOff.Date": {
                  "from": "now-2M",
                  "to": "now"
               }
            }
         }
      }
   }
}

这给我带来了45个文档。哪个是对的。我只是想不通现在如何将汇总应用于这些文档，以便取回所有已用天的总和。

使用此resource我尝试了此aggs，但没有得到正确的结果:

{
   "size": 45,
   "filter": {
      "nested": {
         "path": "DaysOff",
         "filter": {
            "range": {
               "DaysOff.Date": {
                  "from": "now-2M",
                  "to": "now"
               }
            }
         }
      }
   },
   "aggs": {
      "sum_docs": {
         "nested": {
            "path": "DaysOff"
         },
         "aggs": {
            "stepped_down": {
               "sum": {
                  "field": "DaysOff.Days"
               }
            }
         }
      }
   }
}

最佳答案

您需要在这些nested documents上添加filter才能获得正确的结果，



我这样创建索引

POST employee
{
  "mappings": {
    "emp_map": {
      "properties": {
        "DaysOff": {
          "type": "nested",
          "properties": {
            "Date": {
              "type": "date",
              "format": "strict_date_optional_time||epoch_millis"
            },
            "Days": {
              "type": "double"
            },
            "ID": {
              "type": "long"
            }
          }
        },
        "name": {
          "type": "string"
        }
      }
    }
  }
},

然后我索引了一些这样的文档，

PUT employee/emp_map/1
{
  "name" : "messi",
  "DaysOff" : [
    {
     "Date" : "2015-11-01",
     "Days" : 1,
     "ID" : 11
    },
    {
     "Date" : "2014-11-01",
     "Days" : 2,
     "ID" : 11
    },
    {
     "Date" : "2015-12-01",
     "Days" : 0.5,
     "ID" : 11
    }
    ]
}

PUT employee/emp_map/2
{
  "name" : "ronaldo",
  "DaysOff" : [
    {
     "Date" : "2015-10-01",
     "Days" : 3,
     "ID" : 12
    },
    {
     "Date" : "2014-11-01",
     "Days" : 2,
     "ID" : 12
    },
    {
     "Date" : "2015-12-01",
     "Days" : 0.5,
     "ID" : 12
    }
    ]
}

PUT employee/emp_map/3
{
  "name" : "suarez",
  "DaysOff" : [
    {
     "Date" : "2015-11-01",
     "Days" : 4,
     "ID" : 13
    },
    {
     "Date" : "2015-11-09",
     "Days" : 2,
     "ID" : 13
    },
    {
     "Date" : "2015-12-01",
     "Days" : 1.5,
     "ID" : 13
    }
    ]
}

这是我的查询，请注意filter aggregation中的nested aggregation，否则ES将为您提供所有休息日的总和。

GET employee/_search
{
  "query": {
    "bool": {
      "filter": {
        "nested": {
          "path": "DaysOff",
          "query": {
            "range": {
              "DaysOff.Date": {
                "from": "now-2M",
                "to": "now"
              }
            }
          }
        }
      }
    }
  },
  "aggs": {
    "emp_name": {
      "terms": {
        "field": "name",
        "size": 10
      },
      "aggs": {
        "nesting": {
          "nested": {
            "path": "DaysOff"
          },
          "aggs": {
            "filter_date": {
              "filter": {
                "range": {
                  "DaysOff.Date": {
                    "from": "now-2M",
                    "to": "now"
                  }
                }
              },
              "aggs": {
                "sum_taken_off_days": {
                  "sum": {
                    "field": "DaysOff.Days"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "size": 0
}

这是我得到的结果，

"aggregations": {
    "emp_name": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "messi",
          "doc_count": 1,
          "nesting": {
            "doc_count": 3,
            "filter_date": {
              "doc_count": 2,
              "sum_taken_off_days": {
                "value": 1.5
              }
            }
          }
        },
        {
          "key": "ronaldo",
          "doc_count": 1,
          "nesting": {
            "doc_count": 3,
            "filter_date": {
              "doc_count": 1,
              "sum_taken_off_days": {
                "value": 0.5
              }
            }
          }
        },
        {
          "key": "suarez",
          "doc_count": 1,
          "nesting": {
            "doc_count": 3,
            "filter_date": {
              "doc_count": 3,
              "sum_taken_off_days": {
                "value": 7.5
              }
            }
          }
        }
      ]
    }
  }

附言:这是每位员工的，您可以删除emp_name terms aggregation以获取所有员工的总和。

关于elasticsearch - ElasticSearch嵌套过滤器和聚合，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/34371764/