在术语查询中查询/过滤分箱文档？

Question

我有一些共享属性的数据，假设我有这些文档：

{
   session: "session-1",
   status: "New",
},
{
  session: "session-1",
  title: "My session",
},
{
   session: "session-1",
   message: "hi there",
},
{
   session: "session-2",
   status: "Closed",
},
{
   session: "session-2",
   message: "hi!",
},

如果我进行聚合：

body: {
  aggs: {
    sessions: {
      field: "session",
    },
  },
},

我得到两个存储桶，其中包含 3 个和 2 个文档：

"aggregations": {
    "sessions": {
      "doc_count_error_upper_bound": 0,   
      "sum_other_doc_count": 0,           
      "buckets": [                        
        {
          "key": "session-1",
          "doc_count": 3
        },
        {
          "key": "session-2",
          "doc_count": 2
        },
      ]
    }
  }

我可以以某种方式对存储桶运行过滤器或查询吗？

body: {
  aggs: {
    sessions: {
      field: "session",
    },
    aggs: {
      filter_docs: { bool: must [{ match: { message: "hi" } }, { match: { status: "New" } }],
    }
  },
},

我知道我可以对所有文档应用query，但我希望能够在子文档中执行更复杂的过滤器（即过滤掉同时包含message: hi 和status: New 的存储桶)

Answer 1

由于上例中没有包含message: hi 和status: New 的文档。

添加一个工作示例，使用filter aggregation 过滤包含message: Hi 和session: session-1 的文档。

{
  "size": 0,
  "aggs": {
    "filtererd": {
      "filter": {
        "bool": {
          "must": [
            {
              "match": {
                "message": "hi"
              }
            },
            {
              "match": {
                "session.keyword": "session-1"
              }
            }
          ]
        }
      },
      "aggs": {
        "top_filter": {
          "top_hits": {}
        }
      }
    }
  }
}

搜索结果将是

"aggregations": {
    "filtererd": {
      "doc_count": 1,
      "top_filter": {
        "hits": {
          "total": {
            "value": 1,
            "relation": "eq"
          },
          "max_score": 1.0,
          "hits": [
            {
              "_index": "66714173",
              "_type": "_doc",
              "_id": "3",
              "_score": 1.0,
              "_source": {
                "session": "session-1",
                "message": "hi there"
              }
            }
          ]
        }
      }
    }
  }

---

如果要过滤术语聚合的结果

搜索查询：

{
  "size": 0,
  "aggs": {
    "genres": {
      "terms": {
        "field": "session"
      },
      "aggs": {
        "filtererd": {
          "filter": {
            "bool": {
              "must": [
                {
                  "match": {
                    "message": "hi"
                  }
                }
              ]
            }
          }
        }
      }
    }
  }
}

搜索结果将是

"aggregations": {
    "genres": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "session-1",
          "doc_count": 3,
          "filtererd": {
            "doc_count": 1             // note this
          }
        },
        {
          "key": "session-2",
          "doc_count": 2,
          "filtererd": {
            "doc_count": 1
          }
        }
      ]
    }