Elasticsearch使用过滤器对未分析字段进行聚合

Question

not analyzed我的索引上有一个字段:

"city": { "type": "string", "index": "not_analyzed" }

我有一个如下聚合:

"aggs": {
    "city": {
        "terms": {
            "field": "city"
        }
    }
}

这给了我这样的输出:

"aggregations": {
    "city": {
        "doc_count_error_upper_bound": 51,
        "sum_other_doc_count": 12478,
        "buckets": [
            {
                "key": "New York",
                "doc_count": 28420
            },
            {
                "key": "London",
                "doc_count": 23456
            },
            {
                "key": "São Paulo",
                "doc_count": 12727
            }
        ]
    }
}

我需要match_phrase_prefix在处理聚合之前添加一个查询,以根据用户文本过滤我的结果,如下所示:

{
    "size": 0,
    "query": {
        "match_phrase_prefix": {
            "city": "sao"
        }
    },
    "aggs": {
        "city": {
                "terms": {
                    "field": "city"
                }
            }
    }
}

结果是......什么都没有!

"aggregations": {
    "city": {
        "doc_count_error_upper_bound": 0,
        "sum_other_doc_count": 0,
        "buckets": []
    }
}

我期待São Paulo城市的聚合结果.显然,问题是,我的领域应该有lowercase和asciifolding过滤器有一个匹配(圣保罗/巴西),但我不能让我的领域进行分析,因为我不希望有聚集的结果一样São,Paulo,New,York(这是发生了什么所分析字段).

我能做什么？我尝试了很多与映射/查询/ aggs的组合,但我无法让它工作.

任何帮助将不胜感激.

Answer 1

既然是not_analyzed查询术语case-sensitive.你可以使用多领域的映射city有analyzed and non-analyzed fields.

例:

put <index>/<type>/_mapping
{
   "properties": {
      "city": {
         "type": "string",
         "fields": {
            "raw": {
               "type": "string",
               "index": "not_analyzed"
            }
         }
      }
   }
}

post <index>/<type>/_search
{
    "size": 0,
    "query": {
        "match_phrase_prefix": {
            "city": "Sao"
        }
    },
    "aggs": {
        "city": {
                "terms": {
                    "field": "city.raw"
                }
            }
    }
}