kibana-4 - 在elasticsearch中使用带有正斜杠的数据聚合

Question

我有数据，具有这样的属性

apiUrl:/REST/endpoint/123

现在我想显示所有 url，并且我正在尝试使用聚合函数（apiUrl.raw 是多字段的 not_analyzed 部分）：

POST /index/type/_search
{
  "aggregations": {
    "application": {
      "terms": {
        "field": "apiUrl.raw"
      }
    }
  }
}

运行此查询时，不会返回任何结果。我究竟做错了什么？我会期待一些事情（以及发生的次数）：

• /REST/api1/123
• /REST/otherApi/345

谢谢！

Answer 1

您的查询确实返回非空结果。比较并让我们知道有什么区别：

PUT index
PUT index/type/_mapping
{
  "properties" : {
    "apiUrl": {
      "type": "multi_field",
      "fields": {
        "apiUrl": {"type":"string", "index":"analyzed"},
        "raw": {"type":"string", "index":"not_analyzed"}
      }
    }
  }
}
GET index/type/_mapping
PUT index/type/1
{
  "apiUrl":"/REST/api1/123"
}
PUT index/type/2
{
  "apiUrl":"/REST/otherApi/345"
}
GET index/type/_search?fields=apiUrl.raw
GET index/type/_search
{
  "aggregations": {
    "application": {
      "terms": {
        "field": "apiUrl.raw"
      }
    }
  }
}

回复：

{
   "took": 76,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 2,
      "max_score": 1,
      "hits": [
         {
            "_index": "index",
            "_type": "type",
            "_id": "1",
            "_score": 1,
            "_source": {
               "apiUrl": "/REST/api1/123"
            }
         },
         {
            "_index": "index",
            "_type": "type",
            "_id": "2",
            "_score": 1,
            "_source": {
               "apiUrl": "/REST/otherApi/345"
            }
         }
      ]
   },
   "aggregations": {
      "application": {
         "doc_count_error_upper_bound": 0,
         "sum_other_doc_count": 0,
         "buckets": [
            {
               "key": "/REST/api1/123",
               "doc_count": 1
            },
            {
               "key": "/REST/otherApi/345",
               "doc_count": 1
            }
         ]
      }
   }
}