您需要将映射更改为以下内容，即两个地址 AND ces 需要被嵌套 ：

You need to change your mapping to the following, i.e. BOTH addresses AND ces need to be nested:

{
  "aliases": {},
  "mappings": {
    "properties": {
      "created_at": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "data": {
        "properties": {
          "addresses": {
            "type": "nested",            <------ MUST BE NESTED
            "properties": {
              "asn": {
                "type": "long"
              },
              "ces": {
                "type": "nested",        <------ MUST BE NESTED
                "properties": {
                  "banner": {
                    "type": "text",
                    "fields": {
                      "keyword": {
                        "type": "keyword",
                        "ignore_above": 256
                      }
                    }
                  },
                  "desc": {
                    "type": "text",
                    "fields": {
                      "keyword": {
                        "type": "keyword",
                        "ignore_above": 256
                      }
                    }
                  },
                  "output": {
                    "type": "text",
                    "fields": {
                      "keyword": {
                        "type": "keyword",
                        "ignore_above": 256
                      }
                    }
                  }
                }
              }
            }
          },
          "name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "source": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "tag": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      },
      "error": {
        "type": "long"
      },
      "finished_at": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "total": {
        "type": "long"
      }
    }
  }
}

然后，您只需要使用嵌套 inner_hits ：

Then you simply need to use nested inner_hits:

{
  "_source": false,
  "query": {
    "nested": {
      "path": "data.addresses.ces",
      "inner_hits": {},               <---- ADD THIS
      "query": {
        "bool": {
          "should": [
            {
              "term": {
                "data.addresses.ces.desc": "jack"
              }
            },
            {
              "term": {
                "data.addresses.ces.output": "jack"
              }
            }
          ]
        }
      }
    }
  },
  "aggs": {
    "nestedData": {
      "nested": {
        "path": "data.addresses.ces"
      },
      "aggs": {
        "data_desc": {
          "filter": {
            "term": {
              "data.addresses.ces.desc": "jack"
            }
          }
        }
      }
    }
  }
}

响应仅包含嵌套的内部匹配，其中包含 jack

And the response will only contain the nested inner hits containing jack