如何在包含斜杠(/)的字符串类型的elasticsearch字段上进行汇总 [英] How to aggregate on elasticsearch field of type string that includes a slash (/)

问题描述

如何在格式为 11/03/2015 的字符串类型的字段上进行汇总，即将字符串作为日期而不重新索引?例如，考虑Elasticsearch index:sport ， type:athlete :

How to aggregate on field of type string which has a format 11/03/2015 i.e. treat string as date without re-indexing? For example, Consider the mapping for an Elasticsearch index:sport, type:athlete:

curl -XPUT "http://localhost:9200/sports/" -d'
{
  "mappings": {
     "athlete": {
        "properties": {
           "birthdate": {
           "type": "string"    
           },
            "name": {
            "type": "string"
           },
            "score": {
            "type": "integer"
           },
            "sport": {
            "type": "string"
           }
        }
     }
   }
}

出生日期上的汇总似乎使用/分隔字段，因此在 11/03/2015 上汇总为 11 ， 03 ， 2015 ，而不是作为一个整体并对其进行汇总.如何解决这个问题?:

Aggregating on birthdate appears to separate field using the / and therefore aggregates on 11/03/2015 as 11, 03, 2015 rather than taking as a whole and aggregating on it. How to fix this? :

"buckets": [
        {
           "key": "2015",
           "doc_count": 24
        },
        {
           "key": "11",
           "doc_count": 21
        },
        {
           "key": "03",
           "doc_count": 3
        }
      ] 

推荐答案

ES映射默认为分析器.将索引更改为 not_analyzed 可以解决此问题:

ES mapping defaults to analyzer. Changing the index to not_analyzed fixed the problem:

curl -XPUT "http://localhost:9200/sports/" -d'
{
 "mappings": {
    "athlete": {
      "properties": {
        "birthdate": {
          "type": "string", "index" : "not_analyzed"    
            },
        "name": {
        "type": "string"
       },
        "score": {
        "type": "integer"
       },
        "sport": {
        "type": "string"
          }
        }
      }
    }
  }

这篇关于如何在包含斜杠(/)的字符串类型的elasticsearch字段上进行汇总的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！