elasticsearch 具有和聚集的Elasticsearch查询中的问题,elasticsearch,kibana,elasticsearch,Kibana" /> elasticsearch 具有和聚集的Elasticsearch查询中的问题,elasticsearch,kibana,elasticsearch,Kibana" />

elasticsearch 具有和聚集的Elasticsearch查询中的问题

elasticsearch 具有和聚集的Elasticsearch查询中的问题,elasticsearch,kibana,elasticsearch,Kibana,下面是我的弹性文件 { "_index": "records", "_type": "_doc", "_id": "27", "_version": 1, "_score": null, "_source": { "dlvehicleclass": "dlVehicleClass", "challan_offences": [ { "offence_name": "Valid Insurance", "amoun

下面是我的弹性文件

{
  "_index": "records",
  "_type": "_doc",
  "_id": "27",
  "_version": 1,
  "_score": null,
  "_source": {
    "dlvehicleclass": "dlVehicleClass",
    "challan_offences": [
      {
        "offence_name": "Valid Insurance",
        "amount": 100
      },
      {
        "offence_name": "Fail to produce certificate of Fitness",
        "amount": 4000
      },
      {
        "offence_name": "Fail to produce Driving Licence (No DL) ",
        "amount": 1200
      }
    ],
    "challan_status": [
      {
        "challan_status": "Cash",
      }
    ],
  }
}
我想以给定的格式保存数据。 如果challan_状态为“现金”,则

罪行名称及款额

调查期间出示的有效保险证明100

未能出示健康证明(无FC)或无健康证明

未能出示驾驶执照(无驾驶执照)或驾驶时未出示有效的驾驶执照

当我试图获取数据时,得到了以下响应

罪行名称及款额

调查期间出示的有效保险证明4300

未能出示健康证书(无FC)或没有健康证书的驾驶4300

未能出示驾驶执照(无DL)或在没有有效DL 4300的情况下驾驶

您需要将字段“challan_违法行为”从对象类型更改为数据类型 和使用

对象类型被展平,即字段“challan_”将存储为

{
     challan_offences.offence_name="<sometext>",
     challan_offences.amount=100,
     challan_offences.offence_name="<sometext>",
     challan_offences.amount=4000,
     challan_offences.offence_name="<sometext>",
     challan_offences.amount=1200
}
查询:

{
  "aggs": {
    "challan_offences": {
      "nested": {
        "path": "challan_offences"
      },
      "aggs": {
        "offence_name": {
          "terms": {
            "field": "challan_offences.offence_name.keyword"
          },
          "aggs": {
            "amount": {
              "sum": {
                "field": "challan_offences.amount"
              }
            }
          }
        }
      }
    }
  },
  "size": 0,
  "_source": {
    "excludes": []
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "query": {
    "bool": {
      "must": [],
      "should": [],
      "must_not": []
    }
  }
}
结果:

  "aggregations" : {
    "challan_offences" : {
      "doc_count" : 3,
      "offence_name" : {
        "doc_count_error_upper_bound" : 0,
        "sum_other_doc_count" : 0,
        "buckets" : [
          {
            "key" : "Fail to produce Driving Licence (No DL) ",
            "doc_count" : 1,
            "amount" : {
              "value" : 1200.0
            }
          },
          {
            "key" : "Fail to produce certificate of Fitness",
            "doc_count" : 1,
            "amount" : {
              "value" : 4000.0
            }
          },
          {
            "key" : "Valid Insurance",
            "doc_count" : 1,
            "amount" : {
              "value" : 100.0
            }
          }
        ]
      }
    }
  }
您需要将字段“challan_”从对象类型更改为数据类型 和使用

对象类型被展平,即字段“challan_”将存储为

{
     challan_offences.offence_name="<sometext>",
     challan_offences.amount=100,
     challan_offences.offence_name="<sometext>",
     challan_offences.amount=4000,
     challan_offences.offence_name="<sometext>",
     challan_offences.amount=1200
}
查询:

{
  "aggs": {
    "challan_offences": {
      "nested": {
        "path": "challan_offences"
      },
      "aggs": {
        "offence_name": {
          "terms": {
            "field": "challan_offences.offence_name.keyword"
          },
          "aggs": {
            "amount": {
              "sum": {
                "field": "challan_offences.amount"
              }
            }
          }
        }
      }
    }
  },
  "size": 0,
  "_source": {
    "excludes": []
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "query": {
    "bool": {
      "must": [],
      "should": [],
      "must_not": []
    }
  }
}
结果:

  "aggregations" : {
    "challan_offences" : {
      "doc_count" : 3,
      "offence_name" : {
        "doc_count_error_upper_bound" : 0,
        "sum_other_doc_count" : 0,
        "buckets" : [
          {
            "key" : "Fail to produce Driving Licence (No DL) ",
            "doc_count" : 1,
            "amount" : {
              "value" : 1200.0
            }
          },
          {
            "key" : "Fail to produce certificate of Fitness",
            "doc_count" : 1,
            "amount" : {
              "value" : 4000.0
            }
          },
          {
            "key" : "Valid Insurance",
            "doc_count" : 1,
            "amount" : {
              "value" : 100.0
            }
          }
        ]
      }
    }
  }

您使用的查询是什么?{“aggs”:{“2”:{“terms”:{“field”:“challan_officies.officies_name.keyword”,“order”:{“count”:“desc”},“size”:200},“aggs”:{“3”:{“sum”:{“field”:“challan_officies.amount”}},“大小”:0,“_源”:{“排除”:[]},“存储的_字段”:[“*”],“脚本_字段”:{},“查询”:{“bool”:{“必须”:[],“应该”:[],“必须不”:[]}}如果它与我添加的查询相关,请在这里发布,或者如果它是另一个问题,请提出一个单独的问题您使用的查询是什么?{“aggs”:{“2”:{“术语”:{“字段”:“challan_违法行为.违法行为.名称.关键字”,“顺序”:{“计数”:“desc”},“大小”:200},“aggs”:{“3”:{“总和”:{“字段”:“challan_违法行为.金额”},“大小”:0,“来源”:{“排除”:[]},“存储的字段”:[“*”],“脚本字段”:{},“查询”:{“bool”:{“必须”:[],“应该”:[],“不得”:[]}如果它与我添加的查询相关,请在此处发布,或者如果它是另一个问题,请提出一个单独的问题。谢谢兄弟,我已经测试了这个问题并得到了所需的响应。现在,我正在应用程序中尝试。如果它有大量数据,我可以更改映射吗。映射无法更改,您必须在删除时创建索引或使用别名以保留数据谢谢bro我已经对此进行了测试,并得到了所需的响应。现在,我正在应用程序中尝试。如果映射包含大量数据,我是否可以更改映射。映射无法更改,您必须在删除时创建索引或使用别名以保留数据