将sql查询转换为elasticsearch

Question

我需要将此查询转换为弹性搜索，但我面临弹性搜索中 (have) 尚不支持的问题。

Select sum(count) as count,prop1 from ( SELECT Count(*) as count,prop1 FROM [table1] group by prop1,prop2 having count = 1 ) group by prop1 order by count desc limit 10

我在弹性搜索中尝试这个查询：

`GET /analytics_data/_search
{
 "size": 0,
 "query": {
   "bool": {
 "filter": [ 
        { 
          "term":  
          { 
            "field": "test"
            }
        }
      ]
   }
 }, 
 "aggs": {
    "aggregation": {
      "terms": {
       "field": "prop1"
     },
     "aggs": {
       "subaggregation": {
         "terms": {
           "field": "prop2",
           "order": {
             "_count": "desc"
           }
          }
          },
       "test":{
         "bucket_selector": {
           "buckets_path":
           {
             "test1": "_count"
           },
           "script":"params.test1 == 1"
         }
       }
       }
       }
   }
    }`

这是我使用的映射：

    PUT /index
{
    "mappings" : {
        "timeline" : {
            "properties" : {
                "prop1" : {
                    "type" : "keyword"
                },
                "prop2" : {
                    "type" : "keyword"                         
                }
            }
        }
    }
}

但我无法获得 count == 1 的子聚合桶

这是建议答案的输出：

{
  "took": 344,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 852146,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "prop1": {
      "doc_count_error_upper_bound": 646,
      "sum_other_doc_count": 37299,
      "buckets": [
        {
          "key": "porp1-key",
          "doc_count": 348178,
          "prop2": {
            "doc_count_error_upper_bound": 130,
            "sum_other_doc_count": 345325,
            "buckets": [
              {
                "key": "e1552d2d-da84-4588-9b65-16c33848bb94_1",
                "doc_count": 558,
                "prop2_count": {
                  "value": 0
                },
                "prop2_check": {
                  "value": 0
                }
              },
              {
                "key": "04b1a8eb-f876-459b-af9b-855493318dca_426",
                "doc_count": 383,
                "prop2_count": {
                  "value": 0
                },
                "prop2_check": {
                  "value": 0
                }
              },
              {
                "key": "b165d2c7-6a23-4a4d-adbb-3b2a79d4c627_80",
                "doc_count": 344,
                "prop2_count": {
                  "value": 0
                },
                "prop2_check": {
                  "value": 0
                }
              },
              {
                "key": "c4ea55dc-c3b3-492b-98a2-1ad004212c3d_99",
                "doc_count": 297,
                "prop2_count": {
                  "value": 0
                },
                "prop2_check": {
                  "value": 0
                }
              },
              {
                "key": "dfc1ae22-5c7f-49ab-8488-207661b43716_294",
                "doc_count": 264,
                "prop2_count": {
                  "value": 0
                },
                "prop2_check": {
                  "value": 0
                }
              },
              {
                "key": "28815490-e7ce-420b-bab8-57a6ffc3f56a_572",
                "doc_count": 239,
                "prop2_count": {
                  "value": 0
                },
                "prop2_check": {
                  "value": 0
                }
              },
              {
                "key": "c3c56ec8-e0ff-46ea-841d-cc22b2dc65f6_574",
                "doc_count": 217,
                "prop2_count": {
                  "value": 0
                },
                "prop2_check": {
                  "value": 0
                }
              },
              {
                "key": "473289b8-fb73-4cbb-b8d7-a5386846745f_34",
                "doc_count": 187,
                "prop2_count": {
                  "value": 0
                },
                "prop2_check": {
                  "value": 0
                }
              },
              {
                "key": "670cb862-7976-4fd5-ba3f-3f8b7c03d615_11",
                "doc_count": 185,
                "prop2_count": {
                  "value": 0
                },
                "prop2_check": {
                  "value": 0
                }
              },
              {
                "key": "41870755-96dd-4a00-ab76-632a1dfaecb5_341",
                "doc_count": 179,
                "prop2_count": {
                  "value": 0
                },
                "prop2_check": {
                  "value": 0
                }
              }
            ]
          },
          "final": {
            "value": 0
          }
        }    ]
    }
  }
}

Answer 1

试试这个。聚合 final 将为您提供所需的输出。

GET /analytics_data/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "field": "test"
          }
        }
      ]
    }
  },
  "aggs": {
    "prop1": {
      "terms": {
        "field": "prop1",
        "size": 10
      },
      "aggs": {
        "prop2": {
          "terms": {
            "field": "prop2",
            "size": 10
          },
          "aggs": {
            "prop2_count": {
              "value_count": {
                "field": "prop2"
              }
            },
            "prop2_check": {
              "bucket_script": {
                "buckets_path": {
                  "count": "prop2_count.value"
                },
                "script": "(params.count == 1) ? 1 : 0"
              }
            }
          }
        },
        "final": {
          "sum_bucket": {
            "buckets_path": "prop2>prop2_check"
          }
        }
      }
    }
  }
}

工作代码：

PUT prop
{
  "mappings": {
    "prop": {
      "properties": {
        "prop1": {
          "type": "keyword"
        },
        "prop2": {
          "type": "keyword"
        }
      }
    }
  }
}

POST _bulk
{"index":{"_index":"prop","_type":"prop"}}
{"prop1":"p1","prop2":"q1"}
{"index":{"_index":"prop","_type":"prop"}}
{"prop1":"p1","prop2":"q2"}
{"index":{"_index":"prop","_type":"prop"}}
{"prop1":"p1","prop2":"q2"}
{"index":{"_index":"prop","_type":"prop"}}
{"prop1":"p2","prop2":"q5"}
{"index":{"_index":"prop","_type":"prop"}}
{"prop1":"p2","prop2":"q6"}

GET prop/prop/_search
{
  "size": 0,
  "aggs": {
    "prop1": {
      "terms": {
        "field": "prop1",
        "size": 10
      },
      "aggs": {
        "prop2": {
          "terms": {
            "field": "prop2",
            "size": 10
          },
          "aggs": {
            "prop2_count": {
              "value_count": {
                "field": "prop2"
              }
            },
            "prop2_check": {
              "bucket_script": {
                "buckets_path": {
                  "count": "prop2_count.value"
                },
                "script": "(params.count == 1) ? 1 : 0"
              }
            }
          }
        },
        "final":{
          "sum_bucket": {
            "buckets_path": "prop2>prop2_check"
          }
        }
      }
    }
  }
}

输出：

{
  "took": 6,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 5,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "prop1": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "p1",
          "doc_count": 3,
          "prop2": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "q2",
                "doc_count": 2,
                "prop2_count": {
                  "value": 2
                },
                "prop2_check": {
                  "value": 0
                }
              },
              {
                "key": "q1",
                "doc_count": 1,
                "prop2_count": {
                  "value": 1
                },
                "prop2_check": {
                  "value": 1
                }
              }
            ]
          },
          "final": {
            "value": 1
          }
        },
        {
          "key": "p2",
          "doc_count": 2,
          "prop2": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "q5",
                "doc_count": 1,
                "prop2_count": {
                  "value": 1
                },
                "prop2_check": {
                  "value": 1
                }
              },
              {
                "key": "q6",
                "doc_count": 1,
                "prop2_count": {
                  "value": 1
                },
                "prop2_check": {
                  "value": 1
                }
              }
            ]
          },
          "final": {
            "value": 2
          }
        }
      ]
    }
  }
}