Elasticsearch top_hits 聚合结果和 doc_count 不同答案

【问题标题】：Elasticsearch top_hits aggregation result and doc_count are differentElasticsearch top_hits 聚合结果和 doc_count 不同
【发布时间】：2022-01-04 04:23:51
【问题描述】：

查询

GET /someindex/_search
{
   "size": 0,
   "query": {
      "ids": {
         "types": [],
         "values": ["08a2","08a3","03a2","03a3","84a1"]
      }
   },
   "aggregations": {
      "498": {
         "terms": {
            "field": "holderInfo.raw",
            "size": 50
         },
         "aggregations": {
            "tops": {
               "top_hits": {
                  "_source": {
                     "includes": ["uid"]
                  }
               }
            }
         }
      }
   }
}

结果

{
   ...
   "hits": {
      "total": 5,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "498": {
         "doc_count_error_upper_bound": 0,
         "sum_other_doc_count": 0,
         "buckets": [
            {
               "key": "MATSUSHITA ELECTRIC INDUSTRIAL",
               "doc_count": 5,
               "tops": {
                  "hits": {
                     "total": 5,
                     "max_score": 1,
                     "hits": [
                        {
                           "_index": "someindex",
                           "_id": "03a3",
                           "_score": 1,
                           "_source": {
                              "uid": "03a3"
                           }
                        },
                        {
                           "_index": "someindex",
                           "_id": "08a2",
                           "_score": 1,
                           "_source": {
                              "uid": "08a2"
                           }
                        },
                        {
                           "_index": "someindex",
                           "_id": "84a1",
                           "_score": 1,
                           "_source": {
                              "uid": "84a1"
                           }
                        }
                     ]
                  }
               }
            }
         ]
      }
   }
}

“08a2”、“08a3”、“03a2”、“03a3”和“84a1”在 holderInfo.raw 字段中都明显有“MATSUSHITA ELECTRIC INDUSTRIAL”。

因此，doc_count中有5种情况，但top_hits结果中只输出了“03a3”、“08a2”和“84a1”，省略了“08a3”和“03a2”。

查询

GET /someindex/_search
{
   "size": 0,
   "query": {
      "ids": {
         "types": [],
         "values": ["08a2","08a3","03a2","03a3","84a1"]
      }
   },
   "aggregations": {
      "498": {
         "terms": {
            "script": {
               "inline": "doc['holderInfo.raw'].value"
            },
            "size": 50
         }
      }
   }
}

结果

{
   ...
   "hits": {
      "total": 5,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "498": {
         "doc_count_error_upper_bound": 0,
         "sum_other_doc_count": 0,
         "buckets": [
            {
               "key": "MATSUSHITA ELECTRIC INDUSTRIAL",
               "doc_count": 3
            }
         ]
      }
   }
}

另外，与脚本聚合时省略了两种情况。

我想知道为什么缺少一些 uid。

我必须使用 elasticsearch 2.2 版。我想知道是老版本的elasticsearch的bug还是用户的错。

谢谢！

【问题讨论】：

标签： elasticsearch querydsl elasticsearch-aggregation

【解决方案1】：

默认情况下，top_hits aggregation 返回前 3 个热门点击。你只需要增加size参数：

GET /someindex/_search
{
   "size": 0,
   "query": {
      "ids": {
         "types": [],
         "values": ["08a2","08a3","03a2","03a3","84a1"]
      }
   },
   "aggregations": {
      "498": {
         "terms": {
            "field": "holderInfo.raw",
            "size": 50
         },
         "aggregations": {
            "tops": {
               "top_hits": {
                  "size": 5,                   <---- add this
                  "_source": {
                     "includes": ["uid"]
                  }
               }
            }
         }
      }
   }
}

【讨论】：

我明白了。谢谢你。第二个问题的原因是什么？与脚本聚合时省略了两种情况。
奇怪的是，当我用 doc['holderInfo.raw'].value 编写脚本查询时，会输出三个结果，而当我用 doc['holderInfo.raw'] 编写脚本查询时，五个都正常出来。为什么在文档后添加 .value 会减少数量？
你能用values代替value吗？
上帝，非常感谢。它工作正常。您从哪里获得相关信息？
太棒了，很高兴它有帮助！可以看文档here。