要不要也来分享分享一下啊

如何在桶聚合后将桶内元素进行拼接并作为一个新的字段

Elasticsearch | 作者 chanzz | 发布于2022年11月11日 | 阅读数:1572

查询语句如下:
{
"size": 0,
"query": {
"bool": {
"should": [
{
"match": {
"title": "异动信息 行文时间"
}
},
{
"match": {
"value": "异动信息 行文时间"
}
}
]
}
},
"aggs": {
"linkId_group": {
"terms": {
"field": "linkId.keyword",
"size": 5
},
"aggs": {
"bucket_data": {
"top_hits": {
"_source": {
"includes": [
"title",
"value",
"linkId"
]
},
"size": 2
}
}
}
}
}
}
聚合结果如下:
{
"took": 129,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": {
"value": 10000,
"relation": "gte"
},
"max_score": null,
"hits": []
},
"aggregations": {
"linkId_group": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 334033,
"buckets": [
{
"key": "1304729b27483fc3991a6ab24552301c",
"doc_count": 236,
"bucket_data": {
"hits": {
"total": {
"value": 236,
"relation": "eq"
},
"max_score": 20.774427,
"hits": [
{
"_index": "unified-search-a",
"_type": "_doc",
"_id": "wLWeZIQBGLSYSXqsPCne",
"_score": 20.774427,
"_source": {
"linkId": "1304729b27483fc3991a6ab24552301c",
"title": "学生信息 学籍异动信息",
"value": "行文时间: 2016-10-12"
}
},
{
"_index": "unified-search-a",
"_type": "_doc",
"_id": "jLWeZIQBGLSYSXqsPFDo",
"_score": 20.774427,
"_source": {
"linkId": "1304729b27483fc3991a6ab24552301c",
"title": "学生信息 学籍异动信息",
"value": "行文时间: 2018-05-21"
}
}
]
}
}
},
{
"key": "744c73954c5e3c778b8c96dd1b1bb009",
"doc_count": 233,
"bucket_data": {
"hits": {
"total": {
"value": 233,
"relation": "eq"
},
"max_score": 20.774427,
"hits": [
{
"_index": "unified-search-a",
"_type": "_doc",
"_id": "ZbKXZIQBGLSYSXqs25oC",
"_score": 20.774427,
"_source": {
"linkId": "744c73954c5e3c778b8c96dd1b1bb009",
"title": "学生信息 学籍异动信息",
"value": "行文时间: 2017-02-21"
}
},
{
"_index": "unified-search-a",
"_type": "_doc",
"_id": "BrKXZIQBGLSYSXqs25wD",
"_score": 20.774427,
"_source": {
"linkId": "744c73954c5e3c778b8c96dd1b1bb009",
"title": "学生信息 学籍异动信息",
"value": "行文时间: 2017-06-02"
}
}
]
}
}
},
{
"key": "f6805fb3d99f391bb0f43b6bb45d120b",
"doc_count": 232,
"bucket_data": {
"hits": {
"total": {
"value": 232,
"relation": "eq"
},
"max_score": 20.774427,
"hits": [
{
"_index": "unified-search-a",
"_type": "_doc",
"_id": "FLahZIQBGLSYSXqsaG3E",
"_score": 20.774427,
"_source": {
"linkId": "f6805fb3d99f391bb0f43b6bb45d120b",
"title": "学生信息 学籍异动信息",
"value": "行文时间: 2017-03-06"
}
},
{
"_index": "unified-search-a",
"_type": "_doc",
"_id": "crahZIQBGLSYSXqsaG3E",
"_score": 20.774427,
"_source": {
"linkId": "f6805fb3d99f391bb0f43b6bb45d120b",
"title": "学生信息 学籍异动信息",
"value": "行文时间: 2017-09-28"
}
}
]
}
}
},
{
"key": "bf02e128126b30d0ae1d1be222199f96",
"doc_count": 192,
"bucket_data": {
"hits": {
"total": {
"value": 192,
"relation": "eq"
},
"max_score": 20.774427,
"hits": [
{
"_index": "unified-search-a",
"_type": "_doc",
"_id": "crKXZIQBGLSYSXqs26EE",
"_score": 20.774427,
"_source": {
"linkId": "bf02e128126b30d0ae1d1be222199f96",
"title": "学生信息 学籍异动信息",
"value": "行文时间: 2018-10-19"
}
},
{
"_index": "unified-search-a",
"_type": "_doc",
"_id": "XLKXZIQBGLSYSXqs26IE",
"_score": 20.774427,
"_source": {
"linkId": "bf02e128126b30d0ae1d1be222199f96",
"title": "学生信息 学籍异动信息",
"value": "行文时间: 2019-10-10"
}
}
]
}
}
},
{
"key": "ecbbd847e29c3f7ab45440b062c6b7c2",
"doc_count": 189,
"bucket_data": {
"hits": {
"total": {
"value": 189,
"relation": "eq"
},
"max_score": 20.774427,
"hits": [
{
"_index": "unified-search-a",
"_type": "_doc",
"_id": "k7qwZIQBGLSYSXqsBY45",
"_score": 20.774427,
"_source": {
"linkId": "ecbbd847e29c3f7ab45440b062c6b7c2",
"title": "学生信息 学籍异动信息",
"value": "行文时间: 2018-11-29"
}
},
{
"_index": "unified-search-a",
"_type": "_doc",
"_id": "O7qwZIQBGLSYSXqsBZA6",
"_score": 20.774427,
"_source": {
"linkId": "ecbbd847e29c3f7ab45440b062c6b7c2",
"title": "学生信息 学籍异动信息",
"value": "行文时间: 2019-03-06"
}
}
]
}
}
}
]
}
}
}
现在我想把每个 bucket 中的数据拼接起来作为一个新的字段,如拼接 "_source" 中的  "value" 字段,拼接后为 "行文时间: 2019-03-06 行文时间: 2019-03-06",有什么办法能做到吗
已邀请:

FFFrp

赞同来自:

Pipeline Aggregations  里面的bucket_script 试下

要回复问题请先登录注册