ELASTICSEARCH - 根据条件计算唯一值

Question

我想要一个查询，它根据另一个字段的唯一值返回一个字段重复的次数，我有这个 json：

          "name" : james,
          "city" : "chicago" <----------- same
        },
        {
          "name" : james,
          "city" : "san francisco"
        },
        {
          "name" : james,
          "city" : "chicago" <-----------same
        },
         {
          "name" : Mike,
          "city" : "chicago"
        },
         {
          "name" : Mike,
          "city" : "texas"<-----------same
        },
         {
          "name" : Mike,
          "city" : "texas"<-----------same
        },
         {
          "name" : Peter,
          "city" : "chicago"
        },

我想进行一个查询，根据两个字段的唯一值进行计数。例如，james 等于 2，因为有两个相等的字段（名称：james、city、chicago）和一个不同的字段（名称：james、city：san francisco），那么输出将如下所示：

  {
    "key" : "james",
    "doc_count" : 2
  },
  {
    "key" : "Mike",
    "doc_count" : 2
  },
  {
    "key" : "Peter",
    "doc_count" : 1
  },

可以对两个字段进行单值计数吗？

Answer 1

您可以进行两级术语聚合：

{
  "size": 0,
  "aggs": {
    "names": {
      "terms": {
        "field": "name.keyword",
        "size": 10
      },
      "aggs": {
        "citys_by_name": {
          "terms": {
            "field": "city.keyword",
            "size": 10,
            "min_doc_count": 2
          }
        }
      }
    }
  }
}

响应将如下所示：

"aggregations" : {
    "names" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "james",
          "doc_count" : 15,
          "citys_by_name" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "chicago",
                "doc_count" : 14
              }
            ]
          }
        },
        {
          "key" : "Peter",
          "doc_count" : 2,
          "citys_by_name" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "chicago",
                "doc_count" : 2
              }
            ]
          }
        },
        {
          "key" : "mike",
          "doc_count" : 2,
          "citys_by_name" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [ ]
          }
        }
      ]
    }
  }

或者您可以连接字段：

GET test/_search
{
  "size": 0,
  "aggs": {
    "names": {
      "terms": {
        "script": {
          "source": "return doc['name.keyword'].value + ' ' + doc['city.keyword'].value",
          "lang": "painless"
        },
        "field": "name.keyword",
        "size": 10,
        "min_doc_count": 2
      }
    }
  }
}

响应看起来是这样的：

 "aggregations" : {
    "names" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "james chicago",
          "doc_count" : 14
        },
        {
          "key" : "Peter chicago",
          "doc_count" : 2
        }
      ]
    }
  }

如果您想要有关存储桶的更多统计信息，请使用 stats_buckets 聚合：

{
  "size": 0,
  "aggs": {
    "names": {
      "terms": {
        "script": {
          "source": "return doc['name.keyword'].value + ' ' + doc['city.keyword'].value",
          "lang": "painless"
        },
        "field": "name.keyword",
        "size": 10,
        "min_doc_count": 2
      }
    },
   "names_stats":{
      "stats_bucket": {
        "buckets_path":"names._count"
      }
    }
    }
  }

将导致：

"aggregations" : {
    "names" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "james PARIS",
          "doc_count" : 15
        },
        {
          "key" : "james chicago",
          "doc_count" : 13
        },
        {
          "key" : "samuel PARIS",
          "doc_count" : 11
        },
        {
          "key" : "fred PARIS",
          "doc_count" : 2
        }
      ]
    },
    "names_stats" : {
      "count" : 4,
      "min" : 2.0,
      "max" : 15.0,
      "avg" : 10.25,
      "sum" : 41.0
    }
  }