不同字段的Elasticsearch查询

Question

这里有一个我的文件的例子

{
    "@timestamp": "2020-04-24T19:36:52.484Z",
    "token": "123",
    "application": "sso_api_v3",
    "ssoapiv3_method": "GET",
    "ssoapiv3_error_description": "Your access token has expired",
    "code": 401,
    "message": "\"message\"",
    "level": 6,
    "facility": "sso_api_v3",
    "type": "gelf"
}
[...]
{
    "@timestamp": "2020-04-24T19:37:52.484Z",
    "token": "123",
    "application": "sso_api_v3",
    "ssoapiv3_method": "GET",
    "ssoapiv3_error_description": "Your access token has expired",
    "code": 200,
    "message": "\"message\"",
    "level": 6,
    "facility": "sso_api_v3",
    "type": "gelf"
}
[...]

我有大量的请求，我想进行搜索，以获取相同标记的文档，但代码为200和401。我可以得到所有的200，所有的401，但我不能对同一标记进行搜索。

Answer 1

有两种方法可以做到这一点。

1. 条款聚合

查询。

{
  "size": 0, 
   "aggs": {
     "code": {
       "filter": {
         "terms": {
           "code": [
             200,401 --> returns all documengts with code 200 / 401
           ]
         }
       },
       "aggs": {
         "token": { --> creates group of tokens and fetched doc under each
           "terms": {
             "field": "token.keyword",
             "size": 10
           },
           "aggs": {
             "docs": {
               "top_hits": {
                 "size": 10
               }
             }
           }
         }
       }
     }
   }
}

结果：

"aggregations" : {
    "code" : {
      "doc_count" : 1,
      "token" : {
        "doc_count_error_upper_bound" : 0,
        "sum_other_doc_count" : 0,
        "buckets" : [
          {
            "key" : "123",
            "doc_count" : 1,
            "docs" : {
              "hits" : {
                "total" : {
                  "value" : 1,
                  "relation" : "eq"
                },
                "max_score" : 1.0,
                "hits" : [
                  {
                    "_index" : "index9",
                    "_type" : "_doc",
                    "_id" : "16UKynEBAWHHnYGORq-d",
                    "_score" : 1.0,
                    "_source" : {
                      "@timestamp" : "2020-04-24T19:36:52.484Z",
                      "token" : "123",
                      "application" : "sso_api_v3",
                      "ssoapiv3_method" : "GET",
                      "ssoapiv3_error_description" : "Your access token has expired",
                      "code" : 401,
                      "message" : """"message"""",
                      "level" : 6,
                      "facility" : "sso_api_v3",
                      "type" : "gelf"
                    }
                  }
                ]
              }
            }
          }
        ]
      }
    }
  }

2. 字段折叠

返回一个组字段的前1个文档。你可以使用inner_hits来获取该组下的其他文档。

查询：

{
  "query": {
    "terms": {
      "code": [
        200,
        401
      ]
    }
  },
  "collapse": {
    "field": "token.keyword",
    "inner_hits": {
            "name": "docs", 
            "size": 10, 
            "sort": [{ "@timestamp": "asc" }] 
        }
  }
}