Question

我正在使用Elasticsearch术语聚合来从字段中获取唯一值。以下是我使用的代码：

    var res = client.Search<KibanaFaxLog>(s => s
            .Size(0)
            .Query(q => q.MatchAll())
            .Aggregations(a => a
                .Terms("servers", t => t
                    .Field(f => f.ServerURL.Suffix("keyword")))
            )
        );

    result = JsonConvert.SerializeObject(res.Aggregations.Terms("servers").Buckets);

我收到一个空桶的响应： [{}，{}]

以下是我从Kibana开发工具中使用的DSL查询，它可以准确返回结果。

GET efax/_search
{
"size": 0,
"aggregations" : {
    "urls" : {
        "terms" : { "field" : "ServerURL.keyword"}
    }
}}

这似乎是什么问题？

编辑：以下是文档

      {
        "_index" : "efax",
        "_type" : "_doc",
        "_id" : "-VRqgHABF0HYEOSDNhHT",
        "_score" : 1.0,
        "_source" : {
          "PracticeId" : 2,
          "PracticeName" : "Neighborhood Physcians Practice",
          "ServerName" : "baseline01",
          "DataBaseName" : "202685DEV",
          "ServerURL" : "localhost",
          "Status" : -1003,
          "TransactionId" : "",
          "Action" : "Send Fax",
          "SenderFaxNumber" : "555",
          "RecipientFaxNumber" : "444",
          "FaxUser" : "demo.number",
          "FaxSystem" : "efaxer",
          "QueryString" : "ID=483",
          "ActivityTime" : "2020-02-21T08:54:51.648363-05:00",
          "ActivityTimeUTC" : "2020-02-21T13:54:51.648363Z",
          "FailureMessage" : "Authentication error"
        }

编辑：这是我要汇总的特定字段的映射

{...
"ServerURL": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },...
}

编辑：我启用了调试信息，并得到以下响应。

"Successful (200) low level call on POST: /efax/_search?pretty=true&error_trace=true&typed_keys=true # Audit trail of this API call: - [1] HealthyResponse: Node: http://xxx:9200/ Took: 00:00:01.0937463 # Request: {"aggs":{"servers":{"terms":{"field":"ServerURL.keyword"}}},"query":{"match_all":{}},"size":0} # Response: { "took" : 0, "timed_out" : false, "_shards" : { "total" : 5, "successful" : 5, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : 23, "max_score" : 0.0, "hits" : [ ] }, "aggregations" : { "sterms#servers" : { "doc_count_error_upper_bound" : 0, "sum_other_doc_count" : 0, "buckets" : [ { "key" : "ccc.com", "doc_count" : 8 }, { "key" : "http://localhost/", "doc_count" : 5 }, { "key" : "http://www.ccc.com/202685", "doc_count" : 5 }, { "key" : "localhost", "doc_count" : 5 } ] } } } "

在调试信息中似乎请求和响应都很好，但是我上面显示的聚合对象仍然为空

Elasticsearch术语聚合返回空桶

0 个答案: