elasticsearch - 单个对象数组上的Elasticsearch聚合

Question

我的查询搜索结果具有以下结构

[   
     {
        "_index" : "xxxx",
        "_type" : "status",
        "_id" : "01xxxxxxxxxxx",
        "_score" : 6.297049,
        "_source" : {
          "messageDetail" : {
            "errors" : [
              {
                "errorMessage" : ".metaData should have required property 'schemaVersion'"
              }
            ]
          }
        }
      },
      {
        "_index" : "xxxx",
        "_type" : "status",
        "_id" : "076XXXXxxx",
        "_score" : 6.297049,
        "_source" : {
          "messageDetail" : {
            "errors" : [
              {
                "errorMessage" : ".metaData should have required property 'scenarioName'"
              }
            ]
          }
        }
      },
...]

我想聚合messageDetail.errors.errorMessage并创建一个类似 map 的结构，该结构将在键值对中保存不同的错误消息及其发生的次数。
附言-messageDetail.error是单个对象的数组。
有人可以提供相同的任何查询吗？

Answer 1

添加一个包含索引数据(与所给问题的用法相同)，索引映射，搜索查询和搜索结果的工作示例
索引映射:

{
  "mappings": {
    "properties": {
      "messageDetail": {
        "properties": {
          "errors": {
            "properties": {
              "errorMessage": {
                "type": "keyword"
              }
            }
          }
        }
      }
    }
  }
}

搜索查询

{
    "size": 0, 
    "aggs" : {
        "states" : {
            "terms" : { 
                "field" : "messageDetail.errors.errorMessage"
            }
        }
    }
}

搜索结果:

"aggregations": {
    "states": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": ".metaData should have required property 'scenarioName'",
          "doc_count": 1
        },
        {
          "key": ".metaData should have required property 'schemaVersion'",
          "doc_count": 1
        }
      ]
    }