【发布时间】：2019-08-07 14:53:06
【问题描述】：
我正在记录流的分析。当流程开始时，字段“start”设置为“true”，流程结束时将“true”设置为字段“end”。 少数流可能不包含“结束”字段“真”。我想找到流动到底在哪里停止。
我已尝试使用嵌套聚合，但无法获取未结束流的文档。
这是存储在弹性搜索中的数据
[
{
"date": 1565094409535,
"start": "true",
"end": "",
"message": "Select Option",
"context": "third",
"account_id": "123"
},
{
"date": 1565094411152,
"start": "",
"end": "",
"message": "Select Me",
"context": "third",
"account_id": "123"
},
{
"date": 1565094409652,
"start": "true",
"end": "",
"message": "Select option",
"context": "third",
"account_id": "123"
},
{
"date": 1565094409751,
"start": "",
"end": "",
"message": "Select Me",
"context": "third",
"account_id": "123"
},
{
"date": 1565094411187,
"start": "",
"end": "true",
"message": "Bye Bye",
"context": "third",
"account_id": "123"
},
{
"date": 1565094411211,
"start": "true",
"end": "",
"message": "Select option",
"context": "third",
"account_id": "123"
},
{
"date": 1565094411311,
"start": "true",
"end": "",
"message": "How are you",
"context": "second",
"account_id": "123"
}
]
使用的查询：
{
"size": 0,
"query": {
"bool": {
"must": [{
"term": {
"context.keyword": "third"
}
}
]
}
},
"aggs": {
"sessions": {
"terms": {
"field": "account_id.keyword",
"size": 25000
},
"aggs": {
"top_sessions_hits": {
"top_hits": {
"sort": [{
"date": {
"order": "asc"
}
}],
"_source": {
"includes": ["date", "message", "account_id", "start", "end", "context"]
},
"size": 10000
}
}
}
}
}
}
我得到以下输出
{
"took": 37,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 4,
"max_score": 0,
"hits": []
},
"aggregations": {
"sessions": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "123",
"doc_count": 6,
"top_sessions_hits": {
"hits": {
"total": 6,
"max_score": null,
"hits": [
{
"_index": "messages",
"_type": "doc",
"_id": "********",
"_score": null,
"_source": {
"date": 1565094409535,
"start": "true",
"end": "",
"message": "Select Option",
"context": "third",
"account_id": "123"
},
"sort": [
1565094409535
]
},{
"_index": "messages",
"_type": "doc",
"_id": "********",
"_score": null,
"_source": {
"date": 1565094411152,
"start": "",
"end": "",
"message": "Select Me",
"context": "third",
"account_id": "123"
},
"sort": [
1565094411152
]
},
{
"_index": "messages",
"_type": "doc",
"_id": "********",
"_score": null,
"_source": {
"date": 1565094409652,
"start": "true",
"end": "",
"message": "Select option",
"context": "third",
"account_id": "123"
},
"sort": [
1565094409652
]
},
{
"_index": "messages",
"_type": "doc",
"_id": "********",
"_score": null,
"_source": {
"date": 1565094409751,
"start": "",
"end": "",
"message": "Select Me",
"context": "third",
"account_id": "123"
},
"sort": [
1565094409751
]
},
{
"_index": "messages",
"_type": "doc",
"_id": "********",
"_score": null,
"_source": {
"date": 1565094411187,
"start": "",
"end": "true",
"message": "Bye Bye",
"context": "third",
"account_id": "123"
},
"sort": [
1565094411187
]
},
{
"_index": "messages",
"_type": "doc",
"_id": "********",
"_score": null,
"_source": {
"date": 1565094411211,
"start": "true",
"end": "",
"message": "Select option",
"context": "third",
"account_id": "123"
},
"sort": [
1565094411211
]
}
]
}
}
}
]
}
}
}
但我不想获取文档 #3、#4 和 #5，因为流程已完成。
我对弹性搜索很陌生。由于核心人员休假，我正在尝试解决一些问题。请指导我获取文档 #1、#2 和 #6。
【问题讨论】：
-
你是怎么告诉这个
But I don't want to get the document #3, #4 & #5 since the flow was completed.的？基于什么？ -
感谢@JBone 的回复。查询结果中有三个流，第一个流和第二个流（doc #1 和 #6）已启动但未结束。第二个流程已启动（文档#3）并成功结束（文档#5）。我只需要那些不是结束的流程。所以在这种情况下，我只需要文档#1,2&6，它们是流开始但不是结束的。
标签： elasticsearch