Elasticsearch按字段聚合及空字段分组的自定义计算需求咨询

二、处理Series title为null的分组场景 #

原始数据 #

Id:1
Year:1999
Series title : Cool Series
Episode title: ep1

Id:2
Year:2000
Series title : Cool Series
Episode title: ep2

Id:3
Year:2001
Series title : Cool Series
Episode title: ep3

Id:4
Year:2005
Series title : Another series
Episode title: ep1

Id:5
Year:2006
Series title : Another series
Episode title: ep2

Id:6
Year:2008
Series title : null
Episode title: A Movie 1

Id:7
Year:2009
Series title : null
Episode title: The Movie 2

需求 #

用terms聚合按Series title分组，同时让每个null值的条目单独成为一个结果对象。

实现方法 #

默认terms聚合会把所有null值归为一组，要实现每个null条目单独输出，需分两步处理：

1. 对非null的Series title执行聚合（同第一部分查询，添加非null过滤）
2. 单独查询Series title为null的文档，返回每个文档详情

聚合非null系列的查询

{
  "size": 0,
  "query": {
    "bool": {"must_not": {"term": {"Series title": null}}}
  },
  "aggs": {
    "group_series": {
      "terms": {"field": "Series title.keyword"},
      "aggs": {
        "min_year": {"min": {"field": "Year"}},
        "max_year": {"max": {"field": "Year"}}
      }
    }
  }
}

查询null条目

{
  "query": {"term": {"Series title": null}},
  "_source": ["Series title", "Episode title"]
}

合并结果 #

将聚合结果与null文档查询结果按期望格式合并：

最终结果 #

Series title: Cool Series
Custom-field-year: 1999-2001
Total-count: 3

Series title: Another series
Custom-field-year: 2005-2006
Total-count: 2

Series title: null
Ep A Movie 1

Series title: null
Ep The Movie 2

内容的提问来源于stack exchange，提问作者Eva Err