ElasticSearch术语聚合 [英] ElasticSearch term aggregation

问题描述

我正在尝试使用弹性搜索对以下数据执行以下查询的术语聚合，输出将名称分为令牌（见下面的输出）。所以我尝试将os_name映射为multi_field，现在我无法通过它查询。有没有令牌的索引是可能的？例如Fedora Core？

I'm trying to perform a term aggregation using elastic search for the data below with following query, the output breaks the names into tokens (see output below). So I tried mapping the os_name as multi_field and now I am not able to query by it. Is it possible to have index without tokens? such as "Fedora Core"?

查询：

GET /temp/example/_search
{
  "size": 0,
  "aggs": {
     "OS": {
       "terms": {
           "field": "os_name"
       }
     }
  }
}

数据：

...
    {
        "_index": "temp",
        "_type": "example",
        "_id": "3",
        "_score": 1,
        "_source": {
           "title": "system3",
           "os_name": "Fedora Core",
           "os_version": 18
        }
     },
     {
        "_index": "temp",
        "_type": "example",
        "_id": "1",
        "_score": 1,
        "_source": {
           "title": "system1",
           "os_name": "Fedora Core",
           "os_version": 20
        }
     },
     {
        "_index": "temp",
        "_type": "example",
        "_id": "2",
        "_score": 1,
        "_source": {
           "title": "backup",
           "os_name": "Yellow Dog",
           "os_version": 6
        }
     }
...

输出：

       ...
        {
           "key": "core",
           "doc_count": 2
        },
        {
           "key": "fedora",
           "doc_count": 2
        },
        {
           "key": "dog",
           "doc_count": 1
        },
        {
           "key": "yellow",
           "doc_count": 1
        }
       ...

映射：

PUT /temp
{
  "mappings": {
    "example": {
      "properties": {
        "os_name": {
          "type": "string"
        },
        "os_version": {
          "type": "long"
        },
        "title": {
          "type": "string"
        }
      }
    }
  }
}

推荐答案

实际上你应该像这样改变你的映射

Actually you should change your mapping like this

"os_name": {
  "type": "string",
  "fields": {
     "raw": {
        "type": "string",
        "index": "not_analyzed"
     }
  }
},

您的投标应更改为： p>

and your aggs should be changed to:

GET /temp/example/_search
{
  "size": 0,
  "aggs": {
     "OS": {
       "terms": {
           "field": "os_name.raw"
       }
     }
  }
}

这篇关于ElasticSearch术语聚合的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！