9.ElasticSearch系列之聚合

1. 聚合分类

• Bucket Aggregation：系列满足特定条件的文档的集合，如term range

GET kibana_sample_data_flights/_search
{
  "size": 0, // 只显示聚合结果
  "aggs": {
    "flight_dest": {
      "terms": {
        "field": "DestCountry" // 对该字段聚合
      }
    }
  }
}
// 结果示例
{
  "aggregations" : {
    "flight_dest" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 3187,
      "buckets" : [
        {
          "key" : "IT",
          "doc_count" : 2371
        },
        {
          "key" : "US",
          "doc_count" : 1987
        }
      ]
    }
  }
}

• Metric Aggregation：一些数学运算，可以对文档字段进行统计分析, 如min max sum avg

GET kibana_sample_data_flights/_search
{
  "size": 0,
  "aggs": {
    "avg_price": {
      "avg": {
        "field": "AvgTicketPrice"
      }
    },
    "max_price": {
        "avg": {
          "field": "AvgTicketPrice"
        }
    }
  }
}

// 结果示例
{
  "took" : 5,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "max_price" : {
      "value" : 628.2536888148849
    },
    "avg_price" : {
      "value" : 628.2536888148849
    }
  }
}

GET kibana_sample_data_flights/_search
{
  "size": 0, 
  "aggs": {
    "flight_dest": {
      "terms": {
        "field": "DestCountry"
      },
      "aggs": { // 嵌套聚合出目的地的天气与票价信息
        "stat": {
          "stats": {
            "field": "AvgTicketPrice"
          }
        },
        "weather": {
            "terms": {
              "field": "DestWeather"
            }
        }
      }
    }
  }
}

// 结果示例
{
  "aggregations" : {
    "flight_dest" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 3187,
      "buckets" : [
        {
          "key" : "IT",
          "doc_count" : 2371,
          "stat" : {
            "count" : 2371,
            "min" : 100.57646942138672,
            "max" : 1195.3363037109375,
            "avg" : 586.9627099618385,
            "sum" : 1391688.585319519
          },
          "weather" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "Clear",
                "doc_count" : 428
              },
              {
                "key" : "Thunder & Lightning",
                "doc_count" : 164
              }
            ]
          }
        }
      ]
    }
  }
}

• Pipeline Aggregation: 对其他的聚合结果进行二次聚合

• Matrix Aggregation: 支持对多个字段的操作并提供一个结果矩阵

欢迎关注公众号算法小生或沈健的技术博客