Elastic Search 6 嵌套查询聚合

我是弹性搜索查询和聚合的新手。 我有一个带有以下映射的嵌套文档

PUT /company
{
 "mappings": {
 `"data": {
  "properties": {
    "deptId": {
      "type": "keyword"
    },
     "deptName": {
      "type": "keyword"
    },
    "employee": {
      "type": "nested",
      "properties": {
        "empId": {
          "type": "keyword"
        },
        "empName": {
          "type": "text"
        },
        "salary": {
          "type": "float"
        }
       }}}}}}

我已插入示例数据如下

PUT company/data/1
{
"deptId":"1",
"deptName":"HR",
 "employee": [
  {
    "empId": "1",
    "empName": "John",
    "salary":"1000"
  },
   {
    "empId": "2",
    "empName": "Will",
    "salary":"2000"
  }
 ]}

PUT company/data/3
{
  "deptId":"3",
  "deptName":"FINANCE",
   "employee": [
      {
        "empId": "1",
        "empName": "John",
        "salary":"1000"
      },
       {
        "empId": "2",
        "empName": "Will",
        "salary":"2000"
      },
       {
        "empId": "3",
        "empName": "Mark",
        "salary":"4000"
      }]
     }

我如何为以下内容构建查询 DSL

1. 员工人数最多的部门
2. 大多数部门都有员工

我正在使用弹性搜索 6.2.4

您的第一个问题的答案在此链接中嵌套内部文档计数 https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-inner-hits.html哪些统计数据

POST test/_search
{
  "query": {
    "nested": {
      "path": "employee",
      "inner_hits": {} 
    }
  }
}

这回答了您的第二个问题，还可以阅读随附的链接。

GET /my_index/blogpost/_search
{
  "size" : 0,
  "aggs": {
    "employee": { 
      "nested": {
        "path": "employee"
      },
      "aggs": {
        "by_name": {
          "terms": { 
            "field":    "employee.empName"
          }
        }
      }
    }
  }
}

阅读嵌套聚合 https://www.elastic.co/guide/en/elasticsearch/guide/current/nested-aggregation.html

我希望这能为您提供所需的东西。