聚合语句:
curl -XPOST http://localhost:9200/mylogsta ... earch -d '{
"aggs": {
"queue": {
"terms": {
"field": "queue"
}
}
}
}'
es中源数据如下:
"_source": {
"queue": "root.father.child_1.child2",
"user": "hdfs",
"vCores": 2,
"memory": 16384,
"vCoreCapacity": 2,
"memoryCapacity": 4916,
"vcoreSeconds": 6,
"memorySeconds": 51019,
"elapsedTime": 7,
"finishedTime": "2018-07-09T16:08:08+08:00"
}
聚合结果,只能对三级正常聚合,超过三级就会被拆分
"aggregations": {
"queue": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "child2",
"doc_count": 5
},
{
"key": "root.father.child_1",
"doc_count": 5
}
]
}
}
如何能保证一个整体,期望的聚合结果呈现的是"key": "root.father.child_1.child2",不要拆分
curl -XPOST http://localhost:9200/mylogsta ... earch -d '{
"aggs": {
"queue": {
"terms": {
"field": "queue"
}
}
}
}'
es中源数据如下:
"_source": {
"queue": "root.father.child_1.child2",
"user": "hdfs",
"vCores": 2,
"memory": 16384,
"vCoreCapacity": 2,
"memoryCapacity": 4916,
"vcoreSeconds": 6,
"memorySeconds": 51019,
"elapsedTime": 7,
"finishedTime": "2018-07-09T16:08:08+08:00"
}
聚合结果,只能对三级正常聚合,超过三级就会被拆分
"aggregations": {
"queue": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "child2",
"doc_count": 5
},
{
"key": "root.father.child_1",
"doc_count": 5
}
]
}
}
如何能保证一个整体,期望的聚合结果呈现的是"key": "root.father.child_1.child2",不要拆分
1 个回复
strglee
赞同来自:
(如果没有keyword字段,更新mapping建立keyword字段,然后reindex)