想查询最近4小时发送过注册消息的数据，要求ouyu-version不包含230和105的，只显示"ouyu-number","ouyu-version"这两个字段，查询代码如下：
但是结果显示了ouyu-version字段值为230和105的数据，只在最下面的aggregations里显示了ouyu-version不为230和105的其它值。
不知道查询语句哪里不对。
以下是查询结果：
GET /bj-sip_register/_search
{
"aggs": {
"today": {
"filter": {
"range": {
"@timestamp" :{
"gte":"now-4h",
"lt":"now"
}
}
},
"aggs": {
"ouyu-version": {
"terms" : {
"field": "ouyu-version.keyword",
"exclude": ["230", "105"],
"size": 10
},
"aggs": {
"ouyu": {
"cardinality" : {
"field" : "ouyu-number.keyword"
}
}
}
}
}
}
},
"_source": ["ouyu-number","ouyu-version"],
"size":10,
"from": 1
}但是结果显示了ouyu-version字段值为230和105的数据，只在最下面的aggregations里显示了ouyu-version不为230和105的其它值。
不知道查询语句哪里不对。
以下是查询结果：
{
"took" : 874,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 10000,
"relation" : "gte"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "bj-sip_register",
"_type" : "_doc",
"_id" : "bbImE2wBZw_p4NeuVkzG",
"_score" : 1.0,
"_source" : {
"ouyu-number" : "280057",
"ouyu-version" : "105"
}
},
{
"_index" : "bj-sip_register",
"_type" : "_doc",
"_id" : "c7ImE2wBZw_p4NeuV0yG",
"_score" : 1.0,
"_source" : {
"ouyu-number" : "280057",
"ouyu-version" : "105"
}
},
{
"_index" : "bj-sip_register",
"_type" : "_doc",
"_id" : "dbImE2wBZw_p4NeuV0zg",
"_score" : 1.0,
"_source" : {
"ouyu-number" : "280022",
"ouyu-version" : "105"
}
},
{
"_index" : "bj-sip_register",
"_type" : "_doc",
"_id" : "k7ImE2wBZw_p4NeuXkxR",
"_score" : 1.0,
"_source" : {
"ouyu-number" : "280022",
"ouyu-version" : "105"
}
},
{
"_index" : "bj-sip_register",
"_type" : "_doc",
"_id" : "lbImE2wBZw_p4NeuXkyp",
"_score" : 1.0,
"_source" : {
"ouyu-number" : "444166",
"ouyu-version" : "105"
}
},
{
"_index" : "bj-sip_register",
"_type" : "_doc",
"_id" : "prImE2wBZw_p4NeucEyS",
"_score" : 1.0,
"_source" : {
"ouyu-number" : "444166",
"ouyu-version" : "105"
}
},
{
"_index" : "bj-sip_register",
"_type" : "_doc",
"_id" : "qLImE2wBZw_p4NeucEza",
"_score" : 1.0,
"_source" : {
"ouyu-number" : "280023",
"ouyu-version" : "105"
}
},
{
"_index" : "bj-sip_register",
"_type" : "_doc",
"_id" : "sbImE2wBZw_p4Neudkzr",
"_score" : 1.0,
"_source" : {
"ouyu-number" : "280023",
"ouyu-version" : "105"
}
},
{
"_index" : "bj-sip_register",
"_type" : "_doc",
"_id" : "srImE2wBZw_p4Neud0wH",
"_score" : 1.0,
"_source" : {
"ouyu-number" : "18500131732",
"ouyu-version" : "230"
}
},
{
"_index" : "bj-sip_register",
"_type" : "_doc",
"_id" : "s7ImE2wBZw_p4Neud0w7",
"_score" : 1.0,
"_source" : {
"ouyu-number" : "666806",
"ouyu-version" : "230"
}
}
]
},
"aggregations" : {
"today" : {
"doc_count" : 30926,
"ouyu-version" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "229",
"doc_count" : 286,
"ouyu" : {
"value" : 2
}
},
{
"key" : "103",
"doc_count" : 160,
"ouyu" : {
"value" : 1
}
},
{
"key" : "228",
"doc_count" : 160,
"ouyu" : {
"value" : 1
}
}
]
}
}
}
}
4 个回复
fantuan
赞同来自: sailershen
fantuan
赞同来自: sailershen
https://www.elastic.co/guide/e ... .html
其次，你的需求是返回ouyu-number去重的结果，所以你要实现的是用Terms聚合拿到"aggregations"里返回的数据，而不是去拿搜索匹配的文档("hits")。你可以参考下面:
sailershen
赞同来自:
以下是现在的输出结果，ouyu-number字段有很多是重复的：
sailershen
赞同来自:
因为最上面增加了size:0，所以最后面的_source和from去掉了。
整个思路我基本理顺了。
输出结果：