elasticsearch - 使用Elasticsearch在返回的文档中按字段进行存储

Question

我们的索引文档没有完全固定的架构，也就是说，不是每个文档中都有每个字段。有没有一种方法可以基于一组文档中存在的字段(即响应查询)创建存储桶，并计算包含这些字段的文档数量？例如，我刚刚组成的这些文档包含查询的结果:

{"name":"Bob","field1":"value","field2":"value2","field3":"value3"}
{"name":"Sue","field2":"value4","field3":"value5"}
{"name":"Ali","field1":"value6","field2":"value7"}
{"name":"Joe","field3":"value8"}

这是我要提取的信息(不是格式):

  name: 4
field1: 2
field2: 3
field3: 3

有什么方法可以汇总和计算以获得这些结果？

Answer 1

是的，我想您可以这样做:

GET /some_index/some_type/_search?search_type=count
{
  "aggs": {
    "name_bucket": {
      "filter" : { "exists" : { "field" : "name" } }
    },
    "field1_bucket": {
      "filter" : { "exists" : { "field" : "field1" } }
    },
    "field2_bucket": {
      "filter" : { "exists" : { "field" : "field2" } }
    },
    "field3_bucket": {
      "filter" : { "exists" : { "field" : "field3" } }
    }
  }
}

你会得到这样的东西:

   "aggregations": {
      "field3_bucket": {
         "doc_count": 3
      },
      "field1_bucket": {
         "doc_count": 2
      },
      "field2_bucket": {
         "doc_count": 3
      },
      "name_bucket": {
         "doc_count": 4
      }
   }