Filters Aggregation · Elasticsearch 5.4 中文文檔

# Filters Aggregation 原文鏈接 : [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filters-aggregation.html#_literal_other_literal_bucket](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filters-aggregation.html#_literal_other_literal_bucket) 譯文鏈接 :[Filters Aggregation](http://apache.wiki/display/Elasticsearch/Filters+Aggregation?src=contextnavpagetreemode) 貢獻者 : @于永超，[ApacheCN](/display/~apachecn)，[Apache中文網](/display/~apachechina) ## Filters Aggregation 定義多bucket(桶)聚合，其中每個bucket(桶)與過濾器相關聯。每個bucket(桶)將收集與其關聯的過濾器匹配的所有文檔例子： ``` PUT /logs/message/_bulk?refresh { "index" : { "_id" : 1 } } { "body" : "warning: page could not be rendered" } { "index" : { "_id" : 2 } } { "body" : "authentication error" } { "index" : { "_id" : 3 } } { "body" : "warning: connection timed out" } GET logs/_search { "size": 0, "aggs" : { "messages" : { "filters" : { "filters" : { "errors" : { "match" : { "body" : "error" }}, "warnings" : { "match" : { "body" : "warning" }} } } } } } ``` 在上面的例子中，我們分析日志消息。聚合將構建日志消息的兩個集合（桶） - 一個用于所有包含 ?error 的消息，另一個用于包含 warning 的所有消息。響應結果： ``` { "took": 9, "timed_out": false, "_shards": ..., "hits": ..., "aggregations": { "messages": { "buckets": { "errors": { "doc_count": 1 }, "warnings": { "doc_count": 2 } } } } } ``` ### Anonymous filters（匿名過濾器）過濾器字段也可以作為過濾器的數組提供，就像下面的請求一樣 ``` GET logs/_search { "size": 0, "aggs" : { "messages" : { "filters" : { "filters" : [ { "match" : { "body" : "error" }}, { "match" : { "body" : "warning" }} ] } } } } ``` 過濾的buckets（桶）按照請求中提供的順序返回。這個例子的響應結果是： ``` { "took": 4, "timed_out": false, "_shards": ..., "hits": ..., "aggregations": { "messages": { "buckets": [ { "doc_count": 1 }, { "doc_count": 2 } ] } } } ``` ### `Other`?Bucket other_bucket 參數可以為響應添加一個bucket，它將包含所有與給定過濾器不匹配的文檔，該參數的值可以如下所示： false ? ? ?不計算 other?bucket true ? ??如果使用了命名的過濾器,則返回另一個bucket bucket(默認命名為_other_)，如果使用匿名過濾器，則返回最后一個bucket other_bucket_key參數可用于將其他存儲桶的密鑰設置為除默認值_other_之外的值。設置此參數將會將other_bucket參數隱式設置為true。下面的代碼片段顯示了請求另一個bucket被命名為other_messages的響應。 ``` PUT logs/message/4?refresh { "body": "info: user Bob logged out" } GET logs/_search { "size": 0, "aggs" : { "messages" : { "filters" : { "other_bucket_key": "other_messages", "filters" : { "errors" : { "match" : { "body" : "error" }}, "warnings" : { "match" : { "body" : "warning" }} } } } } } ``` 響應將如下所示： ``` { "took": 3, "timed_out": false, "_shards": ..., "hits": ..., "aggregations": { "messages": { "buckets": { "errors": { "doc_count": 1 }, "warnings": { "doc_count": 2 }, "other_messages": { "doc_count": 1 } } } } } ```