如何在 Elasticsearch 中过滤子索引以进行聚合？

Question

我使用通配符 (interactive*) 查询索引以获取两个索引 interactive-foo* 和 interactive-bar* 的所有文档。

对于我的一些聚合，所有索引都是相关的，但对于其他聚合只有 interactive-foo* OR interactive-bar*。所以我只想在聚合中过滤这些“子索引”。

GET _search
{
  "query":{
    "bool": {
      "must": [
        {
          "range": {
            "timestamp": {
              "gte": "2017-08-01 00:00:00",
              "lte": "2017-08-31 23:59:59"
            }
          }
        },
        {
          "match": {
            "key": "SOME_KEY"
          }
        }
      ]
    }
  },
  "size":0,
  "aggs": {
    // This one should be filtered and just count for interactive-bar*
    "bar_count": {
      "value_count": {
        "field": "SOME_FIELD"
      }
    },
    // This one should be filtered and just count for interactive-foo*
    "foo_count": {
      "value_count": {
        "field": "SOME_FIELD"
      }
    }
  }
}

Answer 1

您可以像这样使用filter 聚合：

{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "timestamp": {
              "gte": "2017-08-01 00:00:00",
              "lte": "2017-08-31 23:59:59"
            }
          }
        },
        {
          "match": {
            "key": "SOME_KEY"
          }
        }
      ]
    }
  },
  "size": 0,
  "aggs": {
    "bar_count": {
      "filter": {
        "indices": {
          "indices": ["interactive-bar-*"]
        }
      },
      "aggs": {
        "bar_count": {
          "value_count": {
            "field": "SOME_FIELD"
          }
        }
      }
    },
    "foo_count": {
      "filter": {
        "indices": {
          "indices": ["interactive-foo-*"]
        }
      },
      "aggs": {
        "foo_count": {
          "value_count": {
            "field": "SOME_FIELD"
          }
        }
      }
    }
  }
}

请注意，indices 查询在 ES 5.0 中已被弃用。您应该做的是在 _index 字段上使用 terms 查询并列出您想要包含在聚合中的所有索引，如下所示：

  "size": 0,
  "aggs": {
    "bar_count": {
      "filter": {
        "terms": {
          "_index": ["interactive-foo-2017.08.14", "interactive-foo-2017.08.15"]
        }
      },
      "aggs": {
        "bar_count": {
          "value_count": {
            "field": "SOME_FIELD"
          }
        }
      }
    },
    "foo_count": {
      "filter": {
        "terms": {
          "_index": ["interactive-bar-2017.08.14", "interactive-bar-2017.08.15"]
        }
      },
      "aggs": {
        "foo_count": {
          "value_count": {
            "field": "SOME_FIELD"
          }
        }
      }
    }
  }
}