Elasticsearch多字段聚合：获取字段匹配数据及字段级文档总数

需求与问题 #

需要查询以861开头的手机号（phone字段）与许可证号（licence_num字段），目标是同时获取：

• 每个字段下的具体匹配数据（即符合前缀的字段值及对应文档数）
• 每个字段维度下的总匹配文档数

当前使用的多字段聚合查询仅能返回各字段的匹配项及对应文档数，无法直接得到每个字段的总匹配文档数。

当前查询语句 #

GET emp_details_new/_search 
{
   "_source": [],
   "size": 0,
   "min_score": 1,
   "query": {
      "multi_match": {
        "query": "861",
         "fields": ["licence_num","phone"],
         "type": "phrase_prefix"
      }
   },
   "aggs": {
      "licence_num": {
         "terms": {
            "field": "licence_num.keyword",
            "include": "86.*"
         }
      },
      "phone": {
         "terms": {
            "field": "phone.keyword",
            "include": "86.*"
         }
      }
   }
}

当前输出结果 #

{
  "took" : 31,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 4,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "phone" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "8613789726",
          "doc_count" : 1
        },
        {
          "key" : "8617323318",
          "doc_count" : 1
        }
      ]
    },
    "licence_num" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "8616203799",
          "doc_count" : 1
        },
        {
          "key" : "8616829169",
          "doc_count" : 1
        }
      ]
    }
  }
}

解决方案 #

要获取每个字段的总匹配文档数，需在每个字段的聚合逻辑中嵌套两层结构：

1. 外层用filter聚合筛选出该字段下以861开头的所有文档，其doc_count即为该字段的总匹配文档数
2. 内层用terms聚合展示该字段下的具体匹配项及对应文档数

修改后的查询语句 #

GET emp_details_new/_search 
{
   "_source": [],
   "size": 0,
   "min_score": 1,
   "query": {
      "multi_match": {
        "query": "861",
         "fields": ["licence_num","phone"],
         "type": "phrase_prefix"
      }
   },
   "aggs": {
      "licence_num_total": {
         "filter": {
            "wildcard": {
               "licence_num.keyword": "861*"
            }
         },
         "aggs": {
            "licence_num_details": {
               "terms": {
                  "field": "licence_num.keyword"
               }
            }
         }
      },
      "phone_total": {
         "filter": {
            "wildcard": {
               "phone.keyword": "861*"
            }
         },
         "aggs": {
            "phone_details": {
               "terms": {
                  "field": "phone.keyword"
               }
            }
         }
      }
   }
}

修改后的输出结果 #

{
  "took" : 25,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 4,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "phone_total" : {
      "doc_count" : 2,
      "phone_details" : {
        "doc_count_error_upper_bound" : 0,
        "sum_other_doc_count" : 0,
        "buckets" : [
          {
            "key" : "8613789726",
            "doc_count" : 1
          },
          {
            "key" : "8617323318",
            "doc_count" : 1
          }
        ]
      }
    },
    "licence_num_total" : {
      "doc_count" : 2,
      "licence_num_details" : {
        "doc_count_error_upper_bound" : 0,
        "sum_other_doc_count" : 0,
        "buckets" : [
          {
            "key" : "8616203799",
            "doc_count" : 1
          },
          {
            "key" : "8616829169",
            "doc_count" : 1
          }
        ]
      }
    }
  }
}

结果说明 #

• licence_num_total.doc_count：licence_num字段中以861开头的总文档数
• phone_total.doc_count：phone字段中以861开头的总文档数
• 嵌套的licence_num_details和phone_details：展示对应字段下的具体匹配值及每个值的文档数

内容的提问来源于stack exchange，提问作者Green