【发布时间】：2015-10-07 23:50:24
【问题描述】：
我正在编写动态查询生成，它允许通过映射中的任何字段组合进行聚合。正如下面的映射（截断），有嵌套类型的字段。例如按 [activities.activity,duration] 或 [activities.activity, activities.duration] 或 [applicationName, duration] 聚合
映射：
{
nested: {
properties: {
@timestamp: {
type: "date",
format: "dateOptionalTime"
},
activities: {
type: "nested",
include_in_parent: true,
properties: {
activity: {
type: "string",
index: "not_analyzed"
},
duration: {
type: "long"
},
entry: {
properties: {
blockName: {
type: "string",
index: "not_analyzed"
},
blockid: {
type: "string"
},
time: {
type: "date",
format: "dateOptionalTime"
}
}
},
exit: {
properties: {
blockName: {
type: "string",
index: "not_analyzed"
},
blockid: {
type: "string"
},
time: {
type: "date",
format: "dateOptionalTime"
}
}
},
seq: {
type: "integer"
}
}
},
applicationName: {
type: "string",
index: "not_analyzed"
},
duration: {
type: "long"
}
}
}}
示例文档：
{
"@timestamp": "2015-09-15T17:35:24.020Z",
"duration": "37616",
"applicationName": "my application name",
"activities": [{
"duration": "20362",
"entry": {
"blockid": "2",
"time": "2015-09-15T17:35:24.493Z",
"blockName": "My Self Service"
},
"exit": {
"blockid": "2",
"time": "2015-09-15T17:35:44.855Z",
"blockName": "My Self Service"
},
"seq": 1,
"activity": "Prompter v2.3"
}, {
"duration": "96",
"entry": {
"blockid": "2",
"time": "2015-09-15T17:35:45.268Z",
"blockName": "My Self Service"
},
"exit": {
"blockid": "2",
"time": "2015-09-15T17:35:45.364Z",
"blockName": "My Self Service"
},
"seq": 2,
"activity": "Start v2.5"
}, {
"duration": "15931",
"entry": {
"blockid": "2",
"time": "2015-09-15T17:35:45.669Z",
"blockName": "My Self Service"
},
"exit": {
"blockid": "2",
"time": "2015-09-15T17:36:01.600Z",
"blockName": "My Self Service"
},
"seq": 3,
"activity": "System v2.3"
}]}
示例查询：
{
"size": 0,
"aggs": {
"dim0": {
"nested" : {
"path": "activities"
},
"aggs": {
"dim1": {
"terms": {
"field": "activities.activity"
},
"aggs": {
"dim_reverse":{
"reverse_nested":{},
"aggs":{
"avg_duration": {
"avg": {
"field": "duration"
}
}
}
}
}
}
}
}
}}
问题， 正如您在查询中看到的那样，在对嵌套字段下的根级别字段进行平均时。必须包含 reverse_nested，以便可以看到根级别字段“duration”。这意味着在生成查询时，我们需要检查字段组合，看看父/子字段是否是字段嵌套、嵌套在同一路径下或根级别的情况，然后生成正确的查询。当聚合更多字段时，这可能会更复杂，例如，按 [applicationName, activities.duration, duration,activities.activity] 聚合。有谁知道更优雅的方式来做到这一点？如果我们可以指定绝对路径，逻辑可能会更简单
【问题讨论】：
标签： elasticsearch nested aggregation