regex - 使用Elasticsearch的邮件域的聚合计数

Question

我的索引中包含以下文件:

{
    "name":"rakesh"
    "age":"26"
    "email":"rakesh@gmail.com"
}

{
    "name":"sam"
    "age":"24"
    "email":"samjoe@elastic.com"
}

{
    "name":"joseph"
    "age":"26"
    "email":"joseph@gmail.com"
}

{
    "name":"genny"
    "age":"24"
    "email":"genny@hotmail.com"
}

现在，我需要获取所有邮件域的计数。喜欢:

@gmail.com:2,
@hotmail.com:1,
@elastic.com:1

使用 Elasticsearch 聚合。

我可以找到与给定查询匹配的记录。但是我需要每个域的数量。

在此先感谢您的帮助。

Answer 1

通过创建仅包含电子邮件域名的子字段，可以轻松实现此目的。首先使用适当的分析器创建索引:

PUT my_index
{
  "settings": {
    "index": {
      "analysis": {
        "analyzer": {
          "email_domain_analyzer": {
            "type": "pattern",
            "pattern": "(.+)@",
            "lowercase": true
          }
        }
      }
    }
  },
  "mappings": {
    "doc": {
      "properties": {
        "email": {
          "type": "text",
          "fields": {
            "domain": {
              "type": "text",
              "fielddata": true,
              "analyzer": "email_domain_analyzer"
            }
          }
        }
      }
    }
  }
}

然后创建您的文档:

POST my_index/doc/_bulk
{ "index": {"_id": 1 }}
{ "name":"rakesh", "age":"26", "email":"rakesh@gmail.com" }
{ "index": {"_id": 2 }}
{ "name":"sam", "age":"24", "email":"samjoe@elastic.com" }
{ "index": {"_id": 3 }}
{ "name":"joseph", "age":"26", "email":"joseph@gmail.com" }
{ "index": {"_id": 4 }}
{ "name":"genny", "age":"24", "email":"genny@gmail.com" }

最后，您可以在email.domain字段上进行汇总，然后将确切获得所需的内容:

POST my_index/_search
{
  "size": 0,
  "aggs": {
    "domains": {
      "terms": {
        "field": "email.domain"
      }
    }
  }
}