elasticsearch 具有和聚集的Elasticsearch查询中的问题
下面是我的弹性文件
elasticsearch 具有和聚集的Elasticsearch查询中的问题,
elasticsearch,kibana,
elasticsearch,Kibana,下面是我的弹性文件 { "_index": "records", "_type": "_doc", "_id": "27", "_version": 1, "_score": null, "_source": { "dlvehicleclass": "dlVehicleClass", "challan_offences": [ { "offence_name": "Valid Insurance", "amoun
{
"_index": "records",
"_type": "_doc",
"_id": "27",
"_version": 1,
"_score": null,
"_source": {
"dlvehicleclass": "dlVehicleClass",
"challan_offences": [
{
"offence_name": "Valid Insurance",
"amount": 100
},
{
"offence_name": "Fail to produce certificate of Fitness",
"amount": 4000
},
{
"offence_name": "Fail to produce Driving Licence (No DL) ",
"amount": 1200
}
],
"challan_status": [
{
"challan_status": "Cash",
}
],
}
}
我想以给定的格式保存数据。
如果challan_状态为“现金”,则
罪行名称及款额
调查期间出示的有效保险证明100
未能出示健康证明(无FC)或无健康证明
未能出示驾驶执照(无驾驶执照)或驾驶时未出示有效的驾驶执照
当我试图获取数据时,得到了以下响应
罪行名称及款额
调查期间出示的有效保险证明4300
未能出示健康证书(无FC)或没有健康证书的驾驶4300
未能出示驾驶执照(无DL)或在没有有效DL 4300的情况下驾驶您需要将字段“challan_违法行为”从对象类型更改为数据类型
和使用
对象类型被展平,即字段“challan_”将存储为
{
challan_offences.offence_name="<sometext>",
challan_offences.amount=100,
challan_offences.offence_name="<sometext>",
challan_offences.amount=4000,
challan_offences.offence_name="<sometext>",
challan_offences.amount=1200
}
查询:
{
"aggs": {
"challan_offences": {
"nested": {
"path": "challan_offences"
},
"aggs": {
"offence_name": {
"terms": {
"field": "challan_offences.offence_name.keyword"
},
"aggs": {
"amount": {
"sum": {
"field": "challan_offences.amount"
}
}
}
}
}
}
},
"size": 0,
"_source": {
"excludes": []
},
"stored_fields": [
"*"
],
"script_fields": {},
"query": {
"bool": {
"must": [],
"should": [],
"must_not": []
}
}
}
结果:
"aggregations" : {
"challan_offences" : {
"doc_count" : 3,
"offence_name" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Fail to produce Driving Licence (No DL) ",
"doc_count" : 1,
"amount" : {
"value" : 1200.0
}
},
{
"key" : "Fail to produce certificate of Fitness",
"doc_count" : 1,
"amount" : {
"value" : 4000.0
}
},
{
"key" : "Valid Insurance",
"doc_count" : 1,
"amount" : {
"value" : 100.0
}
}
]
}
}
}
您需要将字段“challan_”从对象类型更改为数据类型
和使用
对象类型被展平,即字段“challan_”将存储为
{
challan_offences.offence_name="<sometext>",
challan_offences.amount=100,
challan_offences.offence_name="<sometext>",
challan_offences.amount=4000,
challan_offences.offence_name="<sometext>",
challan_offences.amount=1200
}
查询:
{
"aggs": {
"challan_offences": {
"nested": {
"path": "challan_offences"
},
"aggs": {
"offence_name": {
"terms": {
"field": "challan_offences.offence_name.keyword"
},
"aggs": {
"amount": {
"sum": {
"field": "challan_offences.amount"
}
}
}
}
}
}
},
"size": 0,
"_source": {
"excludes": []
},
"stored_fields": [
"*"
],
"script_fields": {},
"query": {
"bool": {
"must": [],
"should": [],
"must_not": []
}
}
}
结果:
"aggregations" : {
"challan_offences" : {
"doc_count" : 3,
"offence_name" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Fail to produce Driving Licence (No DL) ",
"doc_count" : 1,
"amount" : {
"value" : 1200.0
}
},
{
"key" : "Fail to produce certificate of Fitness",
"doc_count" : 1,
"amount" : {
"value" : 4000.0
}
},
{
"key" : "Valid Insurance",
"doc_count" : 1,
"amount" : {
"value" : 100.0
}
}
]
}
}
}
您使用的查询是什么?{“aggs”:{“2”:{“terms”:{“field”:“challan_officies.officies_name.keyword”,“order”:{“count”:“desc”},“size”:200},“aggs”:{“3”:{“sum”:{“field”:“challan_officies.amount”}},“大小”:0,“_源”:{“排除”:[]},“存储的_字段”:[“*”],“脚本_字段”:{},“查询”:{“bool”:{“必须”:[],“应该”:[],“必须不”:[]}}如果它与我添加的查询相关,请在这里发布,或者如果它是另一个问题,请提出一个单独的问题您使用的查询是什么?{“aggs”:{“2”:{“术语”:{“字段”:“challan_违法行为.违法行为.名称.关键字”,“顺序”:{“计数”:“desc”},“大小”:200},“aggs”:{“3”:{“总和”:{“字段”:“challan_违法行为.金额”},“大小”:0,“来源”:{“排除”:[]},“存储的字段”:[“*”],“脚本字段”:{},“查询”:{“bool”:{“必须”:[],“应该”:[],“不得”:[]}如果它与我添加的查询相关,请在此处发布,或者如果它是另一个问题,请提出一个单独的问题。谢谢兄弟,我已经测试了这个问题并得到了所需的响应。现在,我正在应用程序中尝试。如果它有大量数据,我可以更改映射吗。映射无法更改,您必须在删除时创建索引或使用别名以保留数据谢谢bro我已经对此进行了测试,并得到了所需的响应。现在,我正在应用程序中尝试。如果映射包含大量数据,我是否可以更改映射。映射无法更改,您必须在删除时创建索引或使用别名以保留数据