blocks|key|2521265|text|下面是实现这一目标的三种方法(主要是两种，尽管我已经提到了三种，前两种是相似的)：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2521266|解决方案1:使用Elasticsearch+DSL|2521267|我已经提到了示例映射、示例文档、示例聚合查询和响应：|2521268|映射：|offset|length|style|BOLD|2521269|请注意，我以multi-field格式创建了所有字段。这意味着对于每个类型为text的字段(例如client_ip+)，您都有它的同级字段client_ip.keyword，它的类型应该是keyword。它位于聚合查询将起作用的这个字段上。|CODE|2521270|除非将Text设置为enabled，否则不能对fielddata类型运行聚合查询。我不建议这样做，如果你必须这样做，最好使用下面提到的多字段。|2521271|PUT+myipindex
{
++"mappings":+{
++++"mydocs":+{
++++++"properties":{
++++++++"client_ip":+{
++++++++++"type":+"text",
++++++++++"fields":+{
++++++++++++"keyword":+{
++++++++++++++"type":+"keyword"
++++++++++++}
++++++++++}
++++++++},
++++++++"method":+{
++++++++++"type":+"text",
++++++++++"fields":+{
++++++++++++"keyword":+{
++++++++++++++"type":+"keyword"
++++++++++++}
++++++++++}
++++++++},
++++++++"response_code":{
++++++++++"type":+"text",
++++++++++"fields":+{
++++++++++++"keyword":+{
++++++++++++++"type":+"keyword"
++++++++++++}
++++++++++}
++++++++}
++++++}
++++}
++}
}|code-block|syntax|javascript|2521272|示例文档：|2521273|POST+myipindex/mydocs/1
{
++"client_ip":+"10.10.10.10",
++"method":+"GET",
++"response_code":+"200"
}

POST+myipindex/mydocs/2
{
++"client_ip":+"10.10.10.10",
++"method":+"GET",
++"response_code":+"200"
}

POST+myipindex/mydocs/3
{
++"client_ip":+"10.10.10.11",
++"method":+"GET",
++"response_code":+"200"
}

POST+myipindex/mydocs/4
{
++"client_ip":+"10.10.10.11",
++"method":+"POST",
++"response_code":+"200"
}|2521274|聚合查询：|2521275|我简单地在下面的树/子聚合表单中创建了3个Terms+Aggregation，以帮助您理解：|2521276|Terms+Aggregation+for+client_ip
-+Terms+Aggregation+for+method
+-+Terms+Aggregation+for+response_code|2521277|以下是实际的查询：|2521278|POST+myipindex/_search
{
++"size":+0,
++"aggs":{
++++"my_ip":{
++++++"terms":+{
++++++++"field":+"client_ip.keyword",
++++++++"size":+10,
++++++++"min_doc_count":+1
++++++},
++++++"aggs":+{
++++++++"my_method":+{
++++++++++"terms":+{
++++++++++++"field":+"method.keyword",
++++++++++++"size":+10,
++++++++++++"min_doc_count":+1
++++++++++},
++++++++++"aggs":+{
++++++++++++"my_response_code":+{
++++++++++++++"terms":+{
++++++++++++++++"field":+"response_code.keyword",
++++++++++++++++"size":+10,
++++++++++++++++"min_doc_count":+1
++++++++++++++}
++++++++++++}
++++++++++}
++++++++}
++++++}
++++}
++}
}|2521279|聚合响应：|2521280|{
++"took"+:+3,
++"timed_out"+:+false,
++"_shards"+:+{
++++"total"+:+5,
++++"successful"+:+5,
++++"skipped"+:+0,
++++"failed"+:+0
++},
++"hits"+:+{
++++"total"+:+4,
++++"max_score"+:+0.0,
++++"hits"+:+[+]
++},
++"aggregations"+:+{
++++"my_ip"+:+{
++++++"doc_count_error_upper_bound"+:+0,
++++++"sum_other_doc_count"+:+0,
++++++"buckets"+:+[
++++++++{
++++++++++"key"+:+"10.10.10.10",
++++++++++"doc_count"+:+2,
++++++++++"my_method"+:+{
++++++++++++"doc_count_error_upper_bound"+:+0,
++++++++++++"sum_other_doc_count"+:+0,
++++++++++++"buckets"+:+[
++++++++++++++{
++++++++++++++++"key"+:+"GET",
++++++++++++++++"doc_count"+:+2,
++++++++++++++++"my_response_code"+:+{
++++++++++++++++++"doc_count_error_upper_bound"+:+0,
++++++++++++++++++"sum_other_doc_count"+:+0,
++++++++++++++++++"buckets"+:+[
++++++++++++++++++++{
++++++++++++++++++++++"key"+:+"200",
++++++++++++++++++++++"doc_count"+:+2
++++++++++++++++++++}
++++++++++++++++++]
++++++++++++++++}
++++++++++++++}
++++++++++++]
++++++++++}
++++++++},
++++++++{
++++++++++"key"+:+"10.10.10.11",
++++++++++"doc_count"+:+2,
++++++++++"my_method"+:+{
++++++++++++"doc_count_error_upper_bound"+:+0,
++++++++++++"sum_other_doc_count"+:+0,
++++++++++++"buckets"+:+[
++++++++++++++{
++++++++++++++++"key"+:+"GET",
++++++++++++++++"doc_count"+:+1,
++++++++++++++++"my_response_code"+:+{
++++++++++++++++++"doc_count_error_upper_bound"+:+0,
++++++++++++++++++"sum_other_doc_count"+:+0,
++++++++++++++++++"buckets"+:+[
++++++++++++++++++++{
++++++++++++++++++++++"key"+:+"200",
++++++++++++++++++++++"doc_count"+:+1
++++++++++++++++++++}
++++++++++++++++++]
++++++++++++++++}
++++++++++++++},
++++++++++++++{
++++++++++++++++"key"+:+"POST",
++++++++++++++++"doc_count"+:+1,
++++++++++++++++"my_response_code"+:+{
++++++++++++++++++"doc_count_error_upper_bound"+:+0,
++++++++++++++++++"sum_other_doc_count"+:+0,
++++++++++++++++++"buckets"+:+[
++++++++++++++++++++{
++++++++++++++++++++++"key"+:+"200",
++++++++++++++++++++++"doc_count"+:+1
++++++++++++++++++++}
++++++++++++++++++]
++++++++++++++++}
++++++++++++++}
++++++++++++]
++++++++++}
++++++++}
++++++]
++++}
++}
}|2521281|解决方案2:将Elasticsearch+DSL与无痛脚本结合使用|2521282|这个解决方案类似于解决方案1，其中我仍然使用术语聚合，但我已经编写了一个自定义脚本来实现这一点。|2521283|考虑到输出格式，我想您可能更喜欢这个而不是解决方案1。|2521284|2521285|POST+myipindex/_search
{
++"size":+0,
++"aggs":+{
++++"myagg":+{
++++++"terms":+{
++++++++"script":+{
++++++++++"source":+"""
++++++++++++return+doc['client_ip.keyword'].value+%2B+",+"+%2B+doc+['method.keyword'].value+%2B+",+"+%2B+doc['response_code.keyword'].value;
++++++++++""",
++++++++++"lang":+"painless"
++++++++}
++++++}
++++}
++}
}|2521286|2521287|{
++"took"+:+3,
++"timed_out"+:+false,
++"_shards"+:+{
++++"total"+:+5,
++++"successful"+:+5,
++++"skipped"+:+0,
++++"failed"+:+0
++},
++"hits"+:+{
++++"total"+:+4,
++++"max_score"+:+0.0,
++++"hits"+:+[+]
++},
++"aggregations"+:+{
++++"myagg"+:+{
++++++"doc_count_error_upper_bound"+:+0,
++++++"sum_other_doc_count"+:+0,
++++++"buckets"+:+[
++++++++{
++++++++++"key"+:+"10.10.10.10,+GET,+200",
++++++++++"doc_count"+:+2
++++++++},
++++++++{
++++++++++"key"+:+"10.10.10.11,+GET,+200",
++++++++++"doc_count"+:+1
++++++++},
++++++++{
++++++++++"key"+:+"10.10.10.11,+POST,+200",
++++++++++"doc_count"+:+1
++++++++}
++++++]
++++}
++}
}|2521288|解决方案3:如果您有Elasticsearch+xpack，则使用SQL访问|2521289|如果您可以访问xpack的SQL+Access特性，那么您可以简单地执行以下查询：|2521290|POST+/_xpack/sql?format=txt
{
++"query":+"SELECT+client_ip,+method,+response_code,+count(*)+FROM+myipindex+GROUP+BY+client_ip,+method,+response_code"

}|2521291|响应：|2521292|+++client_ip+++%7C++++method+++++%7C+response_code+%7C+++COUNT(1)++++
---------------%2B---------------%2B---------------%2B---------------
10.10.10.10++++%7CGET++++++++++++%7C200++++++++++++%7C2++++++++++++++
10.10.10.11++++%7CGET++++++++++++%7C200++++++++++++%7C1++++++++++++++
10.10.10.11++++%7CPOST+++++++++++%7C200++++++++++++%7C1++++++++++++++|2521293|如果这有帮助，请告诉我！|2521294|entityMap|0|LINK|mutability|MUTABLE|url|https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html|1|https://www.elastic.co/guide/en/elasticsearch/reference/current/text.html|2|https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html|3|https://www.elastic.co/guide/en/elasticsearch/reference/current/xpack-sql.html^0|0|0|0|0|3|0|12|4|1C|9|1X|H|2M|7|6|B|0|0|A|7|N|9|3|4|1|0|0|0|5|0|0|0|5|0|L|H|2|0|0|0|0|0|5|0|0|0|0|0|0|5|0|0|0|5|0|0|0|D|A|3|0|0|0|3|0|0|0^^$0|@$1|2|3|4|5|6|7|2F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|2G|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|2H|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|2I|8|@$H|2J|I|2K|J|K]]|9|@]|A|$]]|$1|L|3|M|5|6|7|2L|8|@$H|2M|I|2N|J|N]|$H|2O|I|2P|J|N]|$H|2Q|I|2R|J|N]|$H|2S|I|2T|J|N]]|9|@$H|2U|I|2V|1|2W]]|A|$]]|$1|O|3|P|5|6|7|2X|8|@$H|2Y|I|2Z|J|N]|$H|30|I|31|J|N]]|9|@$H|32|I|33|1|34]]|A|$]]|$1|Q|3|R|5|S|7|35|8|@]|9|@]|A|$T|U]]|$1|V|3|W|5|6|7|36|8|@$H|37|I|38|J|K]]|9|@]|A|$]]|$1|X|3|Y|5|S|7|39|8|@]|9|@]|A|$T|U]]|$1|Z|3|10|5|6|7|3A|8|@$H|3B|I|3C|J|K]]|9|@]|A|$]]|$1|11|3|12|5|6|7|3D|8|@]|9|@$H|3E|I|3F|1|3G]]|A|$]]|$1|13|3|14|5|S|7|3H|8|@]|9|@]|A|$T|U]]|$1|15|3|16|5|6|7|3I|8|@]|9|@]|A|$]]|$1|17|3|18|5|S|7|3J|8|@]|9|@]|A|$T|U]]|$1|19|3|1A|5|6|7|3K|8|@$H|3L|I|3M|J|K]]|9|@]|A|$]]|$1|1B|3|1C|5|S|7|3N|8|@]|9|@]|A|$T|U]]|$1|1D|3|1E|5|6|7|3O|8|@]|9|@]|A|$]]|$1|1F|3|1G|5|6|7|3P|8|@]|9|@]|A|$]]|$1|1H|3|1I|5|6|7|3Q|8|@]|9|@]|A|$]]|$1|1J|3|10|5|6|7|3R|8|@$H|3S|I|3T|J|K]]|9|@]|A|$]]|$1|1K|3|1L|5|S|7|3U|8|@]|9|@]|A|$T|U]]|$1|1M|3|1A|5|6|7|3V|8|@$H|3W|I|3X|J|K]]|9|@]|A|$]]|$1|1N|3|1O|5|S|7|3Y|8|@]|9|@]|A|$T|U]]|$1|1P|3|1Q|5|6|7|3Z|8|@]|9|@]|A|$]]|$1|1R|3|1S|5|6|7|40|8|@]|9|@$H|41|I|42|1|43]]|A|$]]|$1|1T|3|1U|5|S|7|44|8|@]|9|@]|A|$T|U]]|$1|1V|3|1W|5|6|7|45|8|@$H|46|I|47|J|K]]|9|@]|A|$]]|$1|1X|3|1Y|5|S|7|48|8|@]|9|@]|A|$T|U]]|$1|1Z|3|20|5|6|7|49|8|@]|9|@]|A|$]]|$1|21|3|-4|5|6|7|4A|8|@]|9|@]|A|$]]]|22|$23|$5|24|25|26|A|$27|28]]|29|$5|24|25|26|A|$27|2A]]|2B|$5|24|25|26|A|$27|2C]]|2D|$5|24|25|26|A|$27|2E]]]]

Below are the three ways (primarily two, although I've mentioned three, first two are similar) to achieve this:

<h2>Solution 1: Using Elasticsearch DSL</h2>

I've mentioned a sample mapping, sample documents, sample aggregation query and response:

Mapping:

Note that I've created all the fields in <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html" rel="nofollow noreferrer">multi-field</a> format. Which means for every field of type <code>text</code> for e.g. <code>client_ip</code>, you have its sibling field <code>client_ip.keyword</code> which would be of type <code>keyword</code>. It is on this field below aggregation query would work. 

You cannot run aggregation queries on <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/text.html" rel="nofollow noreferrer">Text</a> type unless you have <code>fielddata</code> set as <code>enabled</code>. I wouldn't recommend this instead, iff you have to do this, the best make use of multi-fields as mentioned below. 

<pre><code>PUT myipindex
{
 "mappings": {
 "mydocs": {
 "properties":{
 "client_ip": {
 "type": "text",
 "fields": {
 "keyword": {
 "type": "keyword"
 }
 }
 },
 "method": {
 "type": "text",
 "fields": {
 "keyword": {
 "type": "keyword"
 }
 }
 },
 "response_code":{
 "type": "text",
 "fields": {
 "keyword": {
 "type": "keyword"
 }
 }
 }
 }
 }
 }
}
</code></pre>

Sample Documents:

<pre><code>POST myipindex/mydocs/1
{
 "client_ip": "10.10.10.10",
 "method": "GET",
 "response_code": "200"
}

POST myipindex/mydocs/2
{
 "client_ip": "10.10.10.10",
 "method": "GET",
 "response_code": "200"
}

POST myipindex/mydocs/3
{
 "client_ip": "10.10.10.11",
 "method": "GET",
 "response_code": "200"
}

POST myipindex/mydocs/4
{
 "client_ip": "10.10.10.11",
 "method": "POST",
 "response_code": "200"
}
</code></pre>

Aggregation Query:

I've simply created 3 <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html" rel="nofollow noreferrer">Terms Aggregation</a> in the below tree/sub-aggregation form to help you understand:

<pre><code>Terms Aggregation for client_ip
- Terms Aggregation for method
 - Terms Aggregation for response_code
</code></pre>

Below is the actual query:

<pre><code>POST myipindex/_search
{
 "size": 0,
 "aggs":{
 "my_ip":{
 "terms": {
 "field": "client_ip.keyword",
 "size": 10,
 "min_doc_count": 1
 },
 "aggs": {
 "my_method": {
 "terms": {
 "field": "method.keyword",
 "size": 10,
 "min_doc_count": 1
 },
 "aggs": {
 "my_response_code": {
 "terms": {
 "field": "response_code.keyword",
 "size": 10,
 "min_doc_count": 1
 }
 }
 }
 }
 }
 }
 }
}
</code></pre>

Aggregation Response:

<pre><code>{
 "took" : 3,
 "timed_out" : false,
 "_shards" : {
 "total" : 5,
 "successful" : 5,
 "skipped" : 0,
 "failed" : 0
 },
 "hits" : {
 "total" : 4,
 "max_score" : 0.0,
 "hits" : [ ]
 },
 "aggregations" : {
 "my_ip" : {
 "doc_count_error_upper_bound" : 0,
 "sum_other_doc_count" : 0,
 "buckets" : [
 {
 "key" : "10.10.10.10",
 "doc_count" : 2,
 "my_method" : {
 "doc_count_error_upper_bound" : 0,
 "sum_other_doc_count" : 0,
 "buckets" : [
 {
 "key" : "GET",
 "doc_count" : 2,
 "my_response_code" : {
 "doc_count_error_upper_bound" : 0,
 "sum_other_doc_count" : 0,
 "buckets" : [
 {
 "key" : "200",
 "doc_count" : 2
 }
 ]
 }
 }
 ]
 }
 },
 {
 "key" : "10.10.10.11",
 "doc_count" : 2,
 "my_method" : {
 "doc_count_error_upper_bound" : 0,
 "sum_other_doc_count" : 0,
 "buckets" : [
 {
 "key" : "GET",
 "doc_count" : 1,
 "my_response_code" : {
 "doc_count_error_upper_bound" : 0,
 "sum_other_doc_count" : 0,
 "buckets" : [
 {
 "key" : "200",
 "doc_count" : 1
 }
 ]
 }
 },
 {
 "key" : "POST",
 "doc_count" : 1,
 "my_response_code" : {
 "doc_count_error_upper_bound" : 0,
 "sum_other_doc_count" : 0,
 "buckets" : [
 {
 "key" : "200",
 "doc_count" : 1
 }
 ]
 }
 }
 ]
 }
 }
 ]
 }
 }
}
</code></pre>

<h2>Solution 2: Using Elasticsearch DSL with painless script</h2>

This solution is similar to the solution 1, where I'm still making use of Terms Aggregation but I've written a custom script in order to do this. 

Thought you might want to prefer this over the solution 1, due to the output format. 

Aggregation Query:

<pre><code>POST myipindex/_search
{
 "size": 0,
 "aggs": {
 "myagg": {
 "terms": {
 "script": {
 "source": """
 return doc['client_ip.keyword'].value + ", " + doc ['method.keyword'].value + ", " + doc['response_code.keyword'].value;
 """,
 "lang": "painless"
 }
 }
 }
 }
}
</code></pre>

Aggregation Response:

<pre><code>{
 "took" : 3,
 "timed_out" : false,
 "_shards" : {
 "total" : 5,
 "successful" : 5,
 "skipped" : 0,
 "failed" : 0
 },
 "hits" : {
 "total" : 4,
 "max_score" : 0.0,
 "hits" : [ ]
 },
 "aggregations" : {
 "myagg" : {
 "doc_count_error_upper_bound" : 0,
 "sum_other_doc_count" : 0,
 "buckets" : [
 {
 "key" : "10.10.10.10, GET, 200",
 "doc_count" : 2
 },
 {
 "key" : "10.10.10.11, GET, 200",
 "doc_count" : 1
 },
 {
 "key" : "10.10.10.11, POST, 200",
 "doc_count" : 1
 }
 ]
 }
 }
}
</code></pre>

<h2>Solution 3: Using SQL Access if you have Elasticsearch xpack</h2>

If you have access to xpack's <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/xpack-sql.html" rel="nofollow noreferrer">SQL Access</a> feature, then you can simply execute the below query:

<pre><code>POST /_xpack/sql?format=txt
{
 "query": "SELECT client_ip, method, response_code, count(*) FROM myipindex GROUP BY client_ip, method, response_code"

}
</code></pre>

Response:

<pre><code> client_ip | method | response_code | COUNT(1) 
---------------+---------------+---------------+---------------
10.10.10.10 |GET |200 |2 
10.10.10.11 |GET |200 |1 
10.10.10.11 |POST |200 |1 
</code></pre>

Let me know if this helps!

In elastic I'm trying to count combination of fields values. 

In SQL this would be like

SELECT a, b, COUNT(a) FROM tbl GROUP BY a, b

(My data is Apache logs, and I'm counting combinations of 
client_ip+method+response_code)

Example data

a, b, c, d

a, b, c, d

a, b, c, e

Expected Output

a, b, c, d = 2

a, b, c, e = 1

Fields are all text
Matches should be exact, not fuzzy
Output needs to show the combination and the count
I don't want to enable fielddata on text fields as my code will be opensource so I want minimal changes to out-the-box elastic to mimic users

Spent hours reading and am non the wiser, every example is very different to this. 

Any help appreciated!

I've been looking at:

Cardinal, multiple cardinal
Aggs, Group, Fields vs Keyword

Multi Column Cardinal / Groupby?

在elastic中，我尝试计算字段值的组合。在SQL中，这将类似于从tbl GROUP BY a，b中选择a，b，COUNT(a)(我的数据是Apache logs，我正在计算client_ip+method+response_code的组合)示例数据a，b，c，da，b，c，da，b，c，e预期输出a，b，c，d=2...

问多列基数/分组？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问多列基数/分组？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问多列基数/分组？
EN