如何通过 Elasticsearch 查询获取每个组的所有最新记录？

Question

我有来自这个how-to-get-latest-values-for-each-group-with-an-elasticsearch-query的参考

现在我进行搜索，但聚合只为我返回 10 个文档，它如何显示所有匹配结果？我只显示两个，因为返回响应太长了，谢谢！

我的 ES 查询是：

{
    "size" :1,
    "aggs": {
    "group": {
        "terms": {
            "field": "studentId"
        },
        "aggs": {
            "group_docs": {
                "top_hits": {
                    "size": 1,
                    "sort": [
                        {
                            "timestamp": {
                                "order": "desc"
                            }
                        }
                    ]
                }
            }
        }
    }
  }
}

结果：

{
    "took": 32,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 10000,
            "relation": "gte"
        },
        "max_score": 1.0,
        "hits": [
            {
                "_index": "data",
                "_type": "class",
                "_id": "N-wsrHYB4zCrGLTdS7Ur",
                "_score": 1.0,
                "_source": {
                    "studentId": 144,
                    "timestampstring": "2020-09-02 05:58:04.828",
                    "type": "data"
                }
            }
        ]
    },
    "aggregations": {
        "group": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 99670,
            "buckets": [
                {
                    "key": 131,
                    "doc_count": 579,
                    "group_docs": {
                        "hits": {
                            "total": {
                                "value": 579,
                                "relation": "eq"
                            },
                            "max_score": null,
                            "hits": [
                                   {
                                    "_index": "data",
                                    "_type": "class",
                                    "_id": "SVVj4HYBlaUrIoJst3-o",
                                    "_score": null,
                                    "_source": {
                                        "studentId": 131,
                                        "timestampstring": "2021-01-08 13:06:34.413",
                                        "type": "data"
                                    },
                                    "sort": [
                                        1609340059767
                                    ]
                                }
                            ]
                        }
                    }
                },
                {
                    "key": 147,
                    "doc_count": 529,
                    "group_docs": {
                        "hits": {
                            "total": {
                                "value": 529,
                                "relation": "eq"
                            },
                            "max_score": null,
                            "hits": [
                                {
                                    "_index": "data",
                                    "_type": "class",
                                    "_id": "SVVj4HYBlaUrIoJst3-o",
                                    "_score": null,
                                    "_source": {
                                        "studentId": 147,
                                        "timestampstring": "2021-01-08 13:06:34.413",
                                        "type": "data"
                                    },
                                    "sort": [
                                        1610082394413
                                    ]
                                }
                            ]
                        }
                    }
                }
            ]
        }
    }
}

Answer 1

您需要在术语聚合中添加size param

可以设置size参数来定义应该有多少个term bucket 被从整体条款列表中退回。

{
  "size": 1,
  "aggs": {
    "group": {
      "terms": {
        "field": "studentId",
        "size": 100                // note this
      },
      "aggs": {
        "group_docs": {
          "top_hits": {
            "size": 1,
            "sort": [
              {
                "timestamp": {
                  "order": "desc"
                }
              }
            ]
          }
        }
      }
    }
  }
}

更新 1：

您可以使用stats bucket aggregation，获取唯一studenid的计数

{
  "size": 1,
  "aggs": {
    "group": {
      "terms": {
        "field": "studentId",
        "size": 100 // note this
      },
      "aggs": {
        "group_docs": {
          "top_hits": {
            "size": 1,
            "sort": [
              {
                "timestamp": {
                  "order": "desc"
                }
              }
            ]
          }
        }
      }
    },
    "bucketcount": {
      "stats_bucket": {
        "buckets_path": "group._count"
      }
    }
  }
}