Elasticsearch先聚合再按时间排序返回需要的字段

{
    "query": {
        "bool": {
            "must": [
                {
                    "term": {
                        "area_code": "abc"
                    }
                },
                {
                    "terms": {
                        "person_id": [
                            "86482983",
                            "86485923"
                        ]
                    }
                },
                {
                    "term": {
                        "identity_id": "6"
                    }
                },
                {
                    "term": {
                        "request_uri": "/test/getUserInfo"
                    }
                }
            ]
        }
    },
    "aggs": {
        "group_by_person": {
            "terms": {
                "field": "person_id"
            },
            "aggs": {
                "result_top_hits": {
                    "top_hits": {
                        "_source": {
                            "includes": [
                                "ip","location.city"
                            ]
                        },
                        "sort": [
                            {
                                "request_time": {
                                    "order": "asc"
                                }
                            }
                        ],
                        "size": 1
                    }
                }
            }
        }
    },
    "size": 0
}

返回

{
    "took": 256,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 37,
        "max_score": 0,
        "hits": []
    },
    "aggregations": {
        "group_by_person": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
                {
                    "key": "86482983",
                    "doc_count": 24,
                    "result_top_hits": {
                        "hits": {
                            "total": 24,
                            "max_score": null,
                            "hits": [
                                {
                                    "_index": "nginxLog",
                                    "_type": "doc",
                                    "_id": "sWIKp2QBFB_dp-Y1Asto",
                                    "_score": null,
                                    "_source": {
                                        "ip": "111.199.0.125",
                                        "location": {
                                            "city": "NVpTUTViR3g="
                                        }
                                    },
                                    "sort": [
                                        1531839607000
                                    ]
                                }
                            ]
                        }
                    }
                },
                {
                    "key": "86485923",
                    "doc_count": 13,
                    "result_top_hits": {
                        "hits": {
                            "total": 13,
                            "max_score": null,
                            "hits": [
                                {
                                    "_index": "nginx-access-log",
                                    "_type": "doc",
                                    "_id": "Bn0tqGQBFB_dp-Y1lN6A",
                                    "_score": null,
                                    "_source": {
                                        "ip": "111.2.201.116",
                                        "location": {
                                            "city": "NWI2MzViZWU="
                                        }
                                    },
                                    "sort": [
                                        1531858714000
                                    ]
                                }
                            ]
                        }
                    }
                }
            ]
        }
    }
}

 

posted @ 2019-01-30 15:02  缤纷世界  阅读(6449)  评论(3编辑  收藏  举报