ELK,萌萌哒

对nested类型字段进行查询和聚合

Elasticsearch | 作者 cl1321 | 发布于2019年02月22日 | 阅读数:8715

# 源数据
PUT /my_index/blogpost/1
{
"title": "Nest eggs",
"body": "Making your money work...",
"tags": [ "cash", "shares" ],
"comments": [ # nested字段
{
"name": "John Smith",
"comment": "Great article",
},
{
"name": "Alice White",
"comment": "Yummy yummy",
}
]
}

PUT /my_index/blogpost/2
{
"title": "ES study",
"body": "Study harder and harder...",
"tags": [ "study" ],
"comments": [ # nested字段
{
"name": "John Smith",
"comment": "Bad article",
},
{
"name": "Tom White",
"comment": "More like this please",
}
]
}

PUT /my_index/blogpost/3
{
"title": "Nested field",
"body": "Comments is a nested field...",
"tags": [ "nested", "field" ],
"comments": [ # nested字段
{
"name": "Tomi White",
"comment": "More like this please",
},
{
"name": "Hina Smith",
"comment": "Bad article",
}
]
}

 需求:
1)查询comments字段中,name为John Smith的所有评论,只展示name为John Smith对应的comment,其它comment不展示;
2)统计comments字段中,name为John Smith的各种评论的分布,尝试过以下方法,没有达到预期的目标:

POST /my_index/blogpost/_search
{
"query" : {
"nested" : {
"path" : "comments",
"query" : {
"match" : {
"comments.name" : "John Smith"
}
}
}
},
"aggs": {
"genres": {
"nested" : {
"path" : "comments"
},
"aggs":{
"filter_type":{
"filter": {
"term": {
"comments.name" : "John Smith"
}
},
"aggs":{
"comment_term":{
"terms": {
"field": "comments.comment",
"size": 1000
}
}
}
}
}
}
}
}

 原数据本想设置为如下类型:
PUT /my_index/blogpost/2
{
"title": "ES study",
"body": "Study harder and harder...",
"tags": [ "study" ],
"comments": {
"Tomi White": "More like this please",
"Hina Smith": "Bad article",
}
}
但担心comments字段中的key个数过多,导致mappings过大,才改成nested类型的
改成nested类型后,查询却是个大问题,如果nested类型基础查询不能满足,是否还有其它更好的办法(如:修改mapping并调整数据结构)
 
已邀请:

cl1321 - 85后IT女

赞同来自:

【自我解答】
上面的POST查询可以完美解决问题,只是如果name和comment字段在mapping设置时,如果设置同时支持分词与不分词,则在查询时,需要指定对应的不分词字段,如:raw

要回复问题请先登录注册