ES 嵌套字段、多字段去重


 
         
cardinality  去重


body={
"aggs": { "threat_name_aggs": { "cardinality": { "field": "alert.threat_name.keyword" } } }, "collapse":{ "field":"alert.threat_name.keyword", "inner_hits": { "name": "top_rated", "size": 1 } }, "size": 1 }

 search_result = self.es_client.search(body=body, index=index,filter_path=["hits.hits._source"],_source_includes=["alert.threat_name"])
 
 聚合  

"aggs": { "threat_name_aggs": { "terms": { "field": "alert.threat_name.keyword", "size": 100 } }, "severity_aggs": { "terms": { "field": "alert.severity.keyword", "size": 100 } }, "alarm_type_aggs": { "terms": { "field": "alert.alarm_type.keyword", "size": 1000 } } }
折疊
"collapse":{ "field":"alert.severity.keyword" }, "collapse":{ "field":"alert.alarm_type.keyword" }, "collapse":{ "field":"alert.threat_name.keyword" }, "collapse":{ "field":"alert.level_2_alarm_type.keyword" }, "size": 1000

 


免責聲明!

本站轉載的文章為個人學習借鑒使用,本站對版權不負任何法律責任。如果侵犯了您的隱私權益,請聯系本站郵箱yoyou2525@163.com刪除。



 
粵ICP備18138465號   © 2018-2025 CODEPRJ.COM