elasticsearch 在嵌套字段上聚合

1。我在下面有一个弹性搜索模式。

{
  "mappings": {
    "properties": {
      "process_id": {
        "type": "keyword"
      },
      "user_info": {
        "type": "nested",
        "properties": {
          "first_name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "last_name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "place": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      }
    }
  }
}

POST processes/_bulk 
  {"index":{"_id":1}}
{"process_id": "123", "user_info": [{"first_name": "A", "last_name": "B","place":"London"},{"first_name": "C", "last_name": "D","place":"Moscow"}]}
{"index":{"_id":2}}
{"process_id": "123", "user_info": [{"first_name": "C", "last_name": "B","Place":"Delhi"},{"first_name": "A", "last_name": "D","Place":"Bangalore"}]}

2。我已将以下文档添加到索引中。

{
  "mappings": {
    "properties": {
      "process_id": {
        "type": "keyword"
      },
      "user_info": {
        "type": "nested",
        "properties": {
          "first_name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "last_name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "place": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      }
    }
  }
}

POST processes/_bulk 
  {"index":{"_id":1}}
{"process_id": "123", "user_info": [{"first_name": "A", "last_name": "B","place":"London"},{"first_name": "C", "last_name": "D","place":"Moscow"}]}
{"index":{"_id":2}}
{"process_id": "123", "user_info": [{"first_name": "C", "last_name": "B","Place":"Delhi"},{"first_name": "A", "last_name": "D","Place":"Bangalore"}]}

3。我想搜索进程id为123，名字为A，姓氏为B，并在用户信息所在地进行聚合。我正试着做如下

{   "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "process_id:123"
          }
        },
        {
          "nested": {
            "path": "user_info",
            "query": {
              "query_string": {
                "query": "user_info.first_name:A AND user_info.last_name:B"
              }
            }
          }
        }
      ]
    }   },   "aggs": {
    "user_info": {
      "nested": {
        "path": "user_info"
      },
      "aggs": {
        "user_info.place": {
          "terms": {
            "field": "user_info.place"
          }
        }
      }
    }   } }

---

结果将正确返回第一个文档。然而，field place上的合计返回伦敦和莫斯科。但是，我希望伦敦作为输出返回。我不知道如何进行这项工作。我也尝试过嵌套筛选器搜索聚合，但没有成功。

聚合适用于整个文档，而不仅仅是

嵌套类型

，因此您可以同时看到

位置

。但是，对于您的情况，因为您想知道嵌套文档匹配的是什么，所以可以使用

上面的查询应该提供如下的内部点击：

 "_source" : {
          "process_id" : "123",
          "user_info" : [
            {
              "first_name" : "A",
              "last_name" : "B",
              "place" : "London"
            },
            {
              "first_name" : "C",
              "last_name" : "D",
              "place" : "Moscow"
            }
          ]
        },
        "inner_hits" : {
          "user_info" : {
            "hits" : {
              "total" : {
                "value" : 1,
                "relation" : "eq"
              },
              "max_score" : 1.3862944,
              "hits" : [
                {
                  "_index" : "t1",
                  "_type" : "_doc",
                  "_id" : "1",
                  "_nested" : {
                    "field" : "user_info",
                    "offset" : 0
                  },
                  "_score" : 1.3862944,
                  "_source" : {
                    "first_name" : "A",
                    "last_name" : "B",
                    "place" : "London"
                  }
                }
              ]
            }
          }
        }

---

你所建议的方法存在问题。如果分页限制每页只有10条记录，就不可能得到所有的内部链接。每个文档都有自己的内部链接。内部点击不是所有结果的全局点击是。对的这不是我需要的。我需要类似于聚合的东西，可以在查询中指定的整个数据集上工作