elasticSearch 查询之Aggs查询

Question

以前用的是es1.6，现在打算升级到6.0，有一些api和语法都变了，求助这段查询怎么改6.0才能用？

{
  "aggs": {
    "filterName0": {
      "filter": {
        "and": [
          {
            "matchAll": {}
          }
        ]
      },
      "aggs": {
        "outerGroup0": {
          "nested": {
            "path": "consuming_behavior"
          },
          "aggs": {
            "outerGroup0o": {
              "terms": {
                "field": "consuming_behavior.second_level_type",
                "include": "ZDY00011"
              },
              "aggs": {
                "innerGroup0": {
                  "nested": {
                    "path": "consuming_behavior.health_record"
                  },
                  "aggs": {
                    "innerGroup0i": {
                      "terms": {
                        "field": "consuming_behavior.health_record.value",
                        "order": {
                          "_count": "desc"
                        },
                        "size": 2147483647
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

在1.6中能够使用，但是在 6.0中报错

"error": {
"root_cause": [
{
"type": "parsing_exception",
"reason": "[and] query malformed, no start_object after query name",
"line": 1,
"col": 41
}
],
"type": "parsing_exception",
"reason": "[and] query malformed, no start_object after query name",
"line": 1,
"col": 41
},
"status": 400

Answer 1

要将 Elasticsearch 查询从版本 1.6 升级到 6.0，你需要做一些调整。以下是你的查询经过必要的修改，使其适用于 Elasticsearch 6.0：

1. and 过滤器已被废弃，你应该使用 bool 过滤器。
2. matchAll 应该改为 match_all。

以下是修改后的查询：

{
  "aggs": {
    "filterName0": {
      "filter": {
        "bool": {
          "must": [
            {
              "match_all": {}
            }
          ]
        }
      },
      "aggs": {
        "outerGroup0": {
          "nested": {
            "path": "consuming_behavior"
          },
          "aggs": {
            "outerGroup0o": {
              "terms": {
                "field": "consuming_behavior.second_level_type",
                "include": ["ZDY00011"]
              },
              "aggs": {
                "innerGroup0": {
                  "nested": {
                    "path": "consuming_behavior.health_record"
                  },
                  "aggs": {
                    "innerGroup0i": {
                      "terms": {
                        "field": "consuming_behavior.health_record.value",
                        "order": {
                          "_count": "desc"
                        },
                        "size": 2147483647
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

具体改动如下：

1. 将 "and": [ { "matchAll": {} } ] 替换为 bool 过滤器，并使用 must 条款来包含 match_all。
2. 将 "matchAll": {} 改为 "match_all": {}。
3. include 选项现在应该是一个数组，因此 "include": "ZDY00011" 改为 "include": ["ZDY00011"]。

这样做之后，你的查询就符合 Elasticsearch 6.0 的语法要求了。