不错的尝试，您快到了！这是我想出的。根据您的映射建议，我正在使用的映射如下：
curl -XPUT localhost:9200/test/_mapping/test -d '{ "test": { "properties": { "keyword": { "type": "string", "index": "not_analyzed" }, "items": { "type": "nested", "properties": { "name": { "type": "string" }, "item_property_1": { "type": "string", "index": "not_analyzed" } } } } }}'注意：您需要擦除数据并重新编制索引，因为您无法将字段类型从不是更改
nested为
nested。
然后，我使用您共享的批量查询创建了一些数据：
curl -XPOST localhost:9200/test/test/_bulk -d '{ "index": {}}{ "keyword": "some keyword", "items": [ { "name":"my first item", "item_property_1":"A" }, { "name":"my second item", "item_property_1":"B" }, { "name":"my third item", "item_property_1":"A" } ]}{ "index": {}}{ "keyword": "different keyword", "items": [ { "name":"cool item", "item_property_1":"A" }, { "name":"awesome item", "item_property_1":"C" } ]}'最后，这是可用于获取期望结果的聚合查询。我们首先
keyword使用
terms聚合来进行存储，然后针对每个关键字通过嵌套
item_property_1字段进行存储。由于
items现在是一个
nested类型的，关键是用
nested聚合的
items，然后一个
terms子聚集的
item_property_1领域。
{ "size": 0, "aggregations": { "by_keyword": { "terms": { "field": "keyword" }, "aggs": { "prop_1_count": { "nested": { "path": "items" }, "aggs": { "prop_1": { "terms": { "field": "items.item_property_1" } } } } } } }}在您的数据集上运行该查询将产生以下结果：
{ ... "aggregations" : { "by_keyword" : { "doc_count_error_upper_bound" : 0, "sum_other_doc_count" : 0, "buckets" : [ { "key" : "different keyword", <---- keyword 1 "doc_count" : 1, "prop_1_count" : { "doc_count" : 2, "prop_1" : { "doc_count_error_upper_bound" : 0, "sum_other_doc_count" : 0, "buckets" : [ { <---- buckets for item_property_1 "key" : "A", "doc_count" : 1 }, { "key" : "C", "doc_count" : 1 } ] } } }, { "key" : "some keyword", <---- keyword 2 "doc_count" : 1, "prop_1_count" : { "doc_count" : 3, "prop_1" : { "doc_count_error_upper_bound" : 0, "sum_other_doc_count" : 0, "buckets" : [ { <---- buckets for item_property_1 "key" : "A", "doc_count" : 2 }, { "key" : "B", "doc_count" : 1 } ] } } } ] } }}
