带有子查询的 Elasticsearch 查询答案

【问题标题】：Elasticsearch Query with subquery带有子查询的 Elasticsearch 查询
【发布时间】：2022-10-14 14:42:14
【问题描述】：

我对弹性搜索比较陌生。我可以在开发工具中进行简单的查询。我需要帮助将以下 sql 转换为 es 查询

select c.conversationid from conversations c
where c.conversationid not in
 (select s.conversationid from conversations s 
where s.type='end' and s.conversationid=c.conversationid)

索引如下所示。

conversationid	type
1	start
2	start
1	end
3	start

如果我执行上述查询，我将得到以下结果。

对话ID

【问题讨论】：

尝试使用SQL API。
sql api 不支持子查询{"error": { "reason": "There was internal problem at backend", "details": "Unsupported subquery", "type": "IllegalStateException" }, "status": 503 }

标签： elasticsearch

【解决方案1】：

我用过以下

Terms aggregation

Bucket Selector

询问

{
  "aggs": {
    "conversations": {
      "terms": {
        "field": "conversationid",
        "size": 10
      },
      "aggs": {  --> subaggregation where type == end
        "types": {
          "terms": {
            "field": "type.keyword",
            "include": [
              "end"
            ],
            "size": 10
          }
        },
        "select": {   --> select those terms where there is no bucket for "end"
          "bucket_selector": { 
            "buckets_path": {
              "path": "types._bucket_count"
            },
            "script": "params.path==0"
          }
        }
      }
    }
  }
}

结果

"aggregations" : {
    "conversations" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : 2,
          "doc_count" : 1,
          "types" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [ ]
          }
        },
        {
          "key" : 3,
          "doc_count" : 1,
          "types" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [ ]
          }
        }
      ]
    }
  }

【讨论】：