弹性搜索中按字段值数据聚合

Question

我有以下数据集，我希望根据状态进行汇总。不知道如何比较状态的值与拒绝或成功并获得结果的计数。

{
    "took": 4,
    "timed_out": false,
    "_shards": {
        "total": 3,
        "successful": 3,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 2874,
        "max_score": 1,
        "hits": [
            {
                "_index": "testfiles",
                "_type": "testfiles",
                "_id": "testfile.one",
                "_score": 1,
                "_source": {
                    "businessDate": 20171013,
                    "status": "Success"
                }
            },
            {
                "_index": "testfiles",
                "_type": "testfiles",
                "_id": "testfile.two",
                "_score": 1,
                "_source": {
                    "businessDate": 20171013,
                    "status": "Success"
                }
            },
            {
                "_index": "testfiles",
                "_type": "testfiles",
                "_id": "testfile.three",
                "_score": 1,
                "_source": {
                    "businessDate": 20171013,
                    "status": "Rejected"
                }
            },
            {
                "_index": "testfiles",
                "_type": "testfiles",
                "_id": "testfile.four",
                "_score": 1,
                "_source": {
                    "businessDate": 20171013,
                    "status": "Rejected"
                }
            }
        ]
    }
}

有人可以帮助如何在弹性搜索聚合中实现这一点。

预期的响应如下所示

"aggregations": {
        "success_records": 2,
        "rejected_records": 2
    }

Answer 1

假设status 字段的类型为text，您需要将其更新为multi-fields，并具有聚合所需的keyword 类型。然后使用查询：

GET my_index/_search
{
  "size": 0,
  "aggs": {
    "statuses": {
      "terms": {
        "field": "status.raw"
      }
  }
}

如果您已经将status 作为keyword 字段，则在上述查询中将status.raw 更改为status。