我有一个包含以下字段的弹性搜索索引:
user_id, agent_name, city, ...
我想运行一个查询来选择其中agent_name“agent1”是代理商之一但还有其他代理商的记录,然后选择其代理商位于2个以上城市的记录。
我使用了这个查询:
query = {
"size": 0, # Don't need the actual documents, just the aggregation results
"query": {
{"match": {agent_name: 'agent1'}
},
"aggs": {
"user_ids": {
"terms": {"field": "user_id", "size": 60000},
"aggs": {
"city_count": {"cardinality": {"field": "city"}}
}
}
},
}
在上面的示例中,如果我首先运行查询,则选择所有agent_name值都是“agent1”的记录,然后聚合结果,这样如果agent1在2个城市处于活动状态,我就可以获得结果, 但我希望它选择一条记录,如果它的代理之一是“agent1”并且还有除agent1之外的其他代理,我应该如何更改“查询”部分以获得所需的结果?
我的方法需要初步获得
customer_id
、agent_name
和city
。
样本文件
PUT /agents_and_customers/_bulk
{"create":{"_id":1}}
{"customer_id":1,"agent_name":"Joe","city":"Palmson"}
{"create":{"_id":2}}
{"customer_id":1,"agent_name":"Maggie","city":"Palmson"}
{"create":{"_id":3}}
{"customer_id":1,"agent_name":"Rick","city":"Stoneheim"}
{"create":{"_id":3}}
{"customer_id":2,"agent_name":"Rick","city":"Stoneheim"}
使用
bool
和聚合进行搜索查询
GET /agents_and_customers/_search?filter_path=aggregations
{
"query": {
"bool": {
"must": [
{
"match": {
"customer_id": 1
}
}
],
"must_not": [
{
"match": {
"city": "Palmson"
}
},
{
"match": {
"agent_name": "Joe"
}
}
]
}
},
"aggs": {
"by_agent_name": {
"terms": {
"field": "agent_name.keyword",
"size": 10
}
}
}
}
回应
{
"aggregations" : {
"by_agent_name" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Rick",
"doc_count" : 1
}
]
}
}
}