Elasticsearch, 使用ik分词后，聚合查询的结果是小写字母？

Question

字段值为'AA'时，聚合查询的结果是'aa'，怎样得到原值？

进行如下查询：

POST /113/_search
{
  "query": {
    "query_string": {
      "query": "Jack"
    }
  }, 
    "aggs" : {
      "gender" : {
        "terms" : {
        "field" : "gender"
        }
      },
      "grade" : {
        "terms" : {
            "field" : "grade",
            "order" : {"_count" : "asc"}
        }
      }
    }
}

得到结果：

{
  "hits": {
    "total": 4,
    "max_score": 1.3862944,
    "hits": [
      {
        "_index": "113",
        "_type": "default_type",
        "_id": "1",
        "_score": 0.07419574,
        "_source": {
          "name": "Tome Jack",
          "grade": "AA",
          "gender": 1
        }
      }
    ]
  },
  "aggregations": {
    "grade": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "b",
          "doc_count": 1
        },
        {
          "key": "c",
          "doc_count": 1
        },
        {
          "key": "aa",
          "doc_count": 2
        }
      ]
    }
  }
}

grade字段设置如下

      "grade": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword"
          }
        },
        "analyzer": "ik_max_word",
        "fielddata": true
      },

grade字段的值在聚合查询中被改变了，怎样得到原值？

Answer 1

查询分组的时候，用keyword类型进行处理，不然会按照分词之后的结果进行分组。ES早期版本不会提示这种方式的异常，但是从ES5开始就会提示，并推荐用Significant Terms Aggregation进行处理。

按照你的描述，理解上应该是对grade字段进行全文分组，grade的分组对应字段设置为grade.keyword。这块改写为：

POST /113/_search
{
  "query": {
    "query_string": {
      "query": "Jack"
    }
  }, 
    "aggs" : {
      "gender" : {
        "terms" : {
        "field" : "gender"
        }
      },
      "grade" : {
        "terms" : {
            "field" : "grade.keyword",
            "order" : {"_count" : "asc"}
        }
      }
    }
}