Elasticsearch COUNT() 文本字段

Question

这是question 的扩展。我正在使用的查询，像这样应该计算每小时的条目数。

GET index_with_text/_search
{
  "size": 0,
  "query": {
    "range": {
      "timestamp": {
        "gte": "2021-06-15",
        "lte": "now"
      }
    }
  }, 
  "aggs": {
    "hit_count_per_day": {
      "date_histogram": {
        "field": "timestamp",
        "calendar_interval": "hour"
      }
    }
  }
}

但是我得到了这个......

"error" : {
"root_cause" : [
  {
    "type" : "illegal_argument_exception",
    "reason" : "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [timestamp] in order to load field data by uninverting the inverted index. Note that this can use significant memory."
  },

Answer 1

根据您收到的错误，hit_count_per_day 似乎属于 text 类型。

您不能对只有text 类型的字段执行聚合。要执行date_histogram 聚合，您需要修改索引映射，然后重新索引数据。

您需要使用以下索引映射创建一个新索引，然后重新索引新索引中的数据

{
  "mappings": {
    "properties": {
      "timestamp": {
        "type": "date"
      }
    }
  }
}