更新答案

Tldr;

这不可能仅通过聚合来实现。
您必须以某种方式将这些术语分组到一个字段中。您可以使用运行时字段（因此不需要重新索引）

解决方案

GET /76328180/_search
{
  "size": 0,
  "aggs": {
    "NAME": {
      "terms": {
        "field": "field_agg"
      }
    }
  }
}

什么是field_agg？
在这种情况下：

POST _bulk
{"index":{"_index": "76328180"}}
{"field_1": 1234, "field_2": 234, "field_agg": [1234, 234]}
{"index":{"_index": "76328180"}}
{"field_1": 1234, "field_2": 345, "field_agg": [1234, 345]}
{"index":{"_index": "76328180"}}
{"field_1": 123, "field_2": 1234, "field_agg": [123, 1234]}
{"index":{"_index": "76328180"}}
{"field_1": 234, "field_2": 4567, "field_agg": [234, 4567]}

初步答复

Tldr;

听起来像是filters aggregation的工作。

解决方案

使用以下查询：

GET /76328180/_search
{
  "size": 0, 
  "aggs": {
    "values": {
      "filters": {
        "filters": {
          "1234": {
            "bool": {
              "should": [
                {
                  "term": {
                    "field_1": 1234
                  }
                },
                {
                  "term": {
                    "field_2": 1234
                  }
                }
              ]
            }
          }
        }
      }
    }
  }
}

应该给予你：

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 4,
      "relation": "eq"
    },
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "values": {
      "buckets": {
        "1234": {
          "doc_count": 3
        }
      }
    }
  }
}

复制：

设置：

POST _bulk
{"index":{"_index": "76328180"}}
{"field_1": 1234, "field_2": 234}
{"index":{"_index": "76328180"}}
{"field_1": 1234, "field_2": 345}
{"index":{"_index": "76328180"}}
{"field_1": 123, "field_2": 1234}
{"index":{"_index": "76328180"}}
{"field_1": 234, "field_2": 4567}