一 Metric
单值分析，只输出一个分析结果，包括min/max/avg/sum/cardinality；
- min/max/avg/sum
GET test_search_index/_search
{
"size": 0,
"aggs": {
"min_age": {
"min": {
"field": "age" ##age最小值
}
},
"max_age": {
"max": {
"field": "age" ##age最大值
}
},
"avg_age": {
"avg": {
"field": "age" ##age平均值
}
},
"sum_age": {
"sum": {
"field": "age" ##age之和
}
}
}
}
- cardinality
集合的势，或者基数，指不同数值的个数，类似于sql中的distinct count的概念；
GET test_search_index/_search
{
"size":0,
"aggs":{
"count_of_job":{
"cardinality": {
"field": "job.keyword" ##返回不同工作的个数
}
}
}
}
多值分析，输出多个分析结果，stats/extended stats/percentile/percentile rank/top hits
- stats/extended stats
GET test_search_index/_search
{
"size":0,
"aggs":{
"stats_age":{
"stats": {
"field": "age"
}
}
}
}
//更多统计数据
GET test_search_index/_search
{
"size":0,
"aggs":{
"exstats_salary":{
"extended_stats": {
"field": "salary"
}
}
}
}
- percentile/percentile rank
百分位数统计/百分位数排名
GET test_search_index/_search
{
"size": 0,
"aggs": {
"per_age": {
"percentiles": {
"field": "salary",
"percents": [
95,
99,
99.9
]
}
}
}
}
//百分位数排名
GET test_search_index/_search
{
"size": 0,
"aggs": {
"per_salary": {
"percentile_ranks": {
"field": "salary",
"values": [
11000,
30000
]
}
}
}
}
- top hits
一般用于分桶后获取该桶内最匹配的顶部文档列表，即详情数据；
GET test_search_index/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field": "job.keyword",
"size": 10
},
"aggs": {
"top_employee": {
"top_hits": {
"size": 10,
"sort": [
{
"age": {
"order": "desc"
}
}
]
}
}
}
}
}
}
二 Bucket
- terms
直接按照term分桶，text类型，按照分词后的结果进行分桶；
GET test_search_index/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field": "job",
"size": 5
}
}
}
}
- range
通过指定数值的范围来设定分桶规则；
GET test_search_index/_search
{
"size": 0,
"aggs": {
"salary_range": {
"range": {
"field": "salary",
"ranges": [
{
"key":"<10000",
"to": 10000
},
{
"from": 10000,
"to": 20000
},
{
"key":">20000",
"from": 20000
}
]
}
}
}
}
- date range
通过指定日期的范围来进行分桶；
GET test_search_index/_search
{
"size": 0,
"aggs": {
"date_range": {
"range": {
"field": "birth",
"format": "yyyy",
"ranges": [
{
"from":"1980",
"to": "1990"
},
{
"from": "1990",
"to": "2000"
},
{
"from": "2000"
}
]
}
}
}
}
- historgram
直方图，以固定间隔的策略来分割数据；
GET test_search_index/_search
{
"size":0,
"aggs":{
"salary_hist":{
"histogram": {
"field": "salary",
"interval": 5000,
"extended_bounds": {
"min": 0,
"max": 40000
}
}
}
}
}
- date historgram
针对日期的直方图或者柱状图；
GET test_search_index/_search
{
"size":0,
"aggs":{
"by_year":{
"date_histogram": {
"field": "birth",
"interval": "year",
"format":"yyyy"
}
}
}
}
三 Bucket+Matric
Bucket聚合分析允许通过添加子分析来进一步进行分析，子分析可以是Bucket，也可以时Metric；
- bucket+bucket
GET test_search_index/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field": "job.keyword",
"size": 10
},
"aggs": {
"age_range": {
"range": {
"field": "age",
"ranges": [
{
"to": 20
},
{
"from": 20,
"to": 30
},
{
"from": 30
}
]
}
}
}
}
}
}
- bucket+metric
GET test_search_index/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field": "job.keyword",
"size": 10
},
"aggs": {
"salary": {
"stats": {
"field": "salary"
}
}
}
}
}
}
四 Pipeline
针对聚合分析的结果再次进行聚合分析，支持链式调用，且分析结果会输出原结果中，输出结果与现有聚合分析结果同级，称为Sibling；
- Max/Min/Avg/Sum Bucket
GET test_search_index/_search
{
"size":0,
"aggs":{
"jobs":{
"terms": {
"field": "job.keyword",
"size": 10
},
"aggs":{
"avg_salary":{
"avg": {
"field": "salary"
}
}
}
},
"sum_salary_by_job":{
"sum_bucket": {
"buckets_path": "jobs>avg_salary"
}
}
}
}
- Stats/Extended Stats Bucket
GET test_search_index/_search
{
"size":0,
"aggs":{
"jobs":{
"terms": {
"field": "job.keyword",
"size": 10
},
"aggs":{
"avg_salary":{
"avg": {
"field": "salary"
}
}
}
},
"stats_salary_by_job":{
"stats_bucket": {
"buckets_path": "jobs>avg_salary"
}
}
}
}
- Percentiles Buckets
GET test_search_index/_search
{
"size":0,
"aggs":{
"jobs":{
"terms": {
"field": "job.keyword",
"size": 10
},
"aggs":{
"avg_salary":{
"avg": {
"field": "salary"
}
}
}
},
"percentiles_salary_by_job":{
"percentiles_bucket": {
"buckets_path": "jobs>avg_salary"
}
}
}
}
输出结果内嵌到现有聚合分析结果中，称为parent；
- Deritave
GET test_search_index/_search
{
"size": 0,
"aggs": {
"birth": {
"date_histogram": {
"field": "birth",
"interval": "year",
"min_doc_count": 0
},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
},
"derivative_avg_salary": {
"derivative": {
"buckets_path": "avg_salary"
}
}
}
}
}
}
- Moving Average
GET test_search_index/_search
{
"size": 0,
"aggs": {
"birth": {
"date_histogram": {
"field": "birth",
"interval": "year",
"min_doc_count": 0
},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
},
"mavg_salary": {
"moving_avg": {
"buckets_path": "avg_salary"
}
}
}
}
}
}
- Cumulative Sum
GET test_search_index/_search
{
"size": 0,
"aggs": {
"birth": {
"date_histogram": {
"field": "birth",
"interval": "year",
"min_doc_count": 0
},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
},
"cumulative_salary": {
"cumulative_sum": {
"buckets_path": "avg_salary"
}
}
}
}
}
}
五 Scope
Es聚合分析默认作用范围时query结果集，可以通过filter/post_filter/global改变其作用范围；
- filter
不改变整体query语句的情况下，为某个聚合分析设定过滤条件，从而修改了作用范围；
GET test_search_index/_search
{
"size": 0,
"aggs": {
"jobs_salary_small": {
"filter": {
"range": {
"salary": {
"to": 10000
}
}
},
"aggs": {
"jobs": {
"terms": {
"field": "job.keyword"
}
}
}
},
"jobs": { ##jobs与jobs_salary_small同级
"terms": {
"field": "job.keyword"
}
}
}
}
- post-filter
在聚合分析后，作用于文档过滤；
GET test_search_index/_search
{
"aggs": {
"jobs": {
"terms": {
"field": "job.keyword"
}
}
},
"post_filter": {
"match":{
"job.keyword":"java engineer"
}
}
}
- global
无视query过滤条件，基于全部文档进行分析；
GET test_search_index/_search
{
"query": {
"match": {
"job.keyword": "java engineer"
}
},
"aggs": {
"java_avg_salary": {
"avg": {
"field": "salary"
}
},
"all": {
"global": {},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
}
}
}
}
}
六 Sort
- .与>的区别
##当为json对象时使用>，当为基本数值统计时用.
##以薪水和降序排序
GET test_search_index/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field": "job.keyword",
"size": 10,
"order": [
{
"stats_salary.sum": "desc"
}
]
},
"aggs": {
"stats_salary": {
"stats": {
"field": "salary"
}
}
}
}
}
}
##以5000间隔分桶，分桶的排序依赖于每个桶内大于10岁的平均年龄决定
GET test_search_index/_search
{
"size": 0,
"aggs": {
"salary_hist": {
"histogram": {
"field": "salary",
"interval": 5000,
"order": {
"age>avg_age": "desc"
}
},
"aggs": {
"age": {
"filter": {
"range": {
"age": {
"gte": 10
}
}
},
"aggs": {
"avg_age": {
"avg": {
"field": "age"
}
}
}
}
}
}
}
}