- Bucket Aggregation:一些列满足特定条件的文档的集合;
- Metric Aggregation:一些数学运算,可以对文档字段进行统计分析;
1.会基于数据集计算结果,除了支持在字段上进行计算,同样也支持在脚本(painless script)产生的结果之上进行计算;
2.大多数Metric是数学计算,仅输出一个值:min/max/sum/avg/cardinality;
3.部分metric支持输出多个值:stats/percentiles/percentile_ranks。 - Pipeline Aggregation:对其他的聚合结果进行二次聚合;
- Matrix Aggregation:支持对多个字段的操作并提供一个结果矩阵。
Bucket & Metric 聚合
aggs语法
{
"size": 0,
"aggs": { // 与query同级的关键词
"": { // 自定义的聚合名字
"": { // 聚合的定义:不同的Type + Body
},
"aggs": {} // 子聚合查询
},
"" : {} // 可以包含多个同级的聚合查询
}
}
Metric
一些系列的统计方法,例如count(),min()等。
- 单值分析:只输出一个分析结果:
min、max、avg、sum;
Cardinality(类似于distinct Count)。 - 多值分析:输出多个分析结果:
stats、extended stats;
percentile、percentile rank;
top hits。
demo索引
PUT /employees/
{
"mappings" : {
"properties" : {
"age" : {
"type" : "integer"
},
"gender" : {
"type" : "keyword"
},
"job" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 50
}
}
},
"name" : {
"type" : "keyword"
},
"salary" : {
"type" : "integer"
}
}
}
}
Metric 聚合,找到最低的工资
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"min_salary": {
"min": {
"field":"salary"
}
}
}
}
- 返回
{
"took" : 5,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"min_salary" : {
"value" : 9000.0
}
}
}
Metric 聚合,找到最高的工资
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"max_salary": {
"max": {
"field":"salary"
}
}
}
}
- 返回
{
"took" : 2,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"max_salary" : {
"value" : 50000.0
}
}
}
多个 Metric 聚合,找到最低最高和平均工资
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"max_salary": {
"max": {
"field": "salary"
}
},
"min_salary": {
"min": {
"field": "salary"
}
},
"avg_salary": {
"avg": {
"field": "salary"
}
}
}
}
- 返回
{
"took" : 5,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"max_salary" : {
"value" : 50000.0
},
"avg_salary" : {
"value" : 24700.0
},
"min_salary" : {
"value" : 9000.0
}
}
}
一个聚合,输出多值
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"stats_salary": {
"stats": {
"field":"salary"
}
}
}
}
- 返回
{
"took" : 4,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"stats_salary" : {
"count" : 20,
"min" : 9000.0,
"max" : 50000.0,
"avg" : 24700.0,
"sum" : 494000.0
}
}
}
百分位数
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"percentiles_salary": {
"percentiles": {
"field":"salary"
}
}
}
}
- 返回
{
"took" : 14,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"percentiles_salary" : {
"values" : {
"1.0" : 9000.0,
"5.0" : 12500.0,
"25.0" : 19000.0,
"50.0" : 22000.0,
"75.0" : 30000.0,
"95.0" : 44000.0,
"99.0" : 50000.0
}
}
}
}
百分比排位
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"percentiles_salary": {
"percentile_ranks": {
"field":"salary",
"values": [30000]
}
}
}
}
- 返回
{
"took" : 4,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"percentiles_salary" : {
"values" : {
"30000.0" : 75.0
}
}
}
}
distinct count
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"gender_count": {
"cardinality": {
"field":"gender"
}
}
}
}
- 返回
{
"took" : 13,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"gender_count" : {
"value" : 2
}
}
}
Bucket
按照一定规则,将文档分配到不同的桶中,从而达到分类的目的。
- Terms (相当于 group by)
- 数字类型:Range/ Data Range、Histogram/ Data Histogram
也支持嵌套,就是在桶里面再做分桶。
对keword类型字段 进行聚合
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field":"job.keyword"
}
}
}
}
- 返回
{
"took" : 17,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"jobs" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Java Programmer",
"doc_count" : 7
},
{
"key" : "Javascript Programmer",
"doc_count" : 4
},
{
"key" : "QA",
"doc_count" : 3
},
{
"key" : "DBA",
"doc_count" : 2
},
{
"key" : "Web Designer",
"doc_count" : 2
},
{
"key" : "Dev Manager",
"doc_count" : 1
},
{
"key" : "Product Manager",
"doc_count" : 1
}
]
}
}
}
对 Text 字段进行 terms 分词。分词后的terms
- 请求
// 对 Text 字段打开 fielddata,支持terms aggregation
PUT employees/_mapping
{
"properties" : {
"job":{
"type": "text",
"fielddata": true
}
}
}
POST employees/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field":"job"
}
}
}
}
- 返回
{
"took" : 4,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"jobs" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "programmer",
"doc_count" : 11
},
{
"key" : "java",
"doc_count" : 7
},
{
"key" : "javascript",
"doc_count" : 4
},
{
"key" : "qa",
"doc_count" : 3
},
{
"key" : "dba",
"doc_count" : 2
},
{
"key" : "designer",
"doc_count" : 2
},
{
"key" : "manager",
"doc_count" : 2
},
{
"key" : "web",
"doc_count" : 2
},
{
"key" : "dev",
"doc_count" : 1
},
{
"key" : "product",
"doc_count" : 1
}
]
}
}
}
指定 bucket 的 size
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"ages_5": {
"terms": {
"field":"age",
"size":3
}
}
}
}
- 返回
{
"took" : 8,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"ages_5" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 12,
"buckets" : [
{
"key" : 25,
"doc_count" : 3
},
{
"key" : 32,
"doc_count" : 3
},
{
"key" : 27,
"doc_count" : 2
}
]
}
}
}
不同工种中,年纪最大的3个员工的具体信息 top hits
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field":"job.keyword"
},
"aggs":{
"old_employee":{
"top_hits":{
"size":3,
"sort":[
{
"age":{
"order":"desc"
}
}
]
}
}
}
}
}
}
- 返回
{
"took" : 13,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"jobs" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Java Programmer",
"doc_count" : 7,
"old_employee" : {
"hits" : {
"total" : {
"value" : 7,
"relation" : "eq"
},
"max_score" : null,
"hits" : [
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "11",
"_score" : null,
"_source" : {
"name" : "Jenny",
"age" : 36,
"job" : "Java Programmer",
"gender" : "female",
"salary" : 38000
},
"sort" : [
36
]
},
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "15",
"_score" : null,
"_source" : {
"name" : "King",
"age" : 33,
"job" : "Java Programmer",
"gender" : "male",
"salary" : 28000
},
"sort" : [
33
]
},
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "9",
"_score" : null,
"_source" : {
"name" : "Gregory",
"age" : 32,
"job" : "Java Programmer",
"gender" : "male",
"salary" : 22000
},
"sort" : [
32
]
}
]
}
}
},
{
"key" : "Javascript Programmer",
"doc_count" : 4,
"old_employee" : {
"hits" : {
"total" : {
"value" : 4,
"relation" : "eq"
},
"max_score" : null,
"hits" : [
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "14",
"_score" : null,
"_source" : {
"name" : "Marshall",
"age" : 32,
"job" : "Javascript Programmer",
"gender" : "male",
"salary" : 25000
},
"sort" : [
32
]
},
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "18",
"_score" : null,
"_source" : {
"name" : "Catherine",
"age" : 29,
"job" : "Javascript Programmer",
"gender" : "female",
"salary" : 20000
},
"sort" : [
29
]
},
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "17",
"_score" : null,
"_source" : {
"name" : "Goodwin",
"age" : 25,
"job" : "Javascript Programmer",
"gender" : "male",
"salary" : 16000
},
"sort" : [
25
]
}
]
}
}
},
{
"key" : "QA",
"doc_count" : 3,
"old_employee" : {
"hits" : {
"total" : {
"value" : 3,
"relation" : "eq"
},
"max_score" : null,
"hits" : [
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "6",
"_score" : null,
"_source" : {
"name" : "Lucy",
"age" : 31,
"job" : "QA",
"gender" : "female",
"salary" : 25000
},
"sort" : [
31
]
},
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "7",
"_score" : null,
"_source" : {
"name" : "Byrd",
"age" : 27,
"job" : "QA",
"gender" : "male",
"salary" : 20000
},
"sort" : [
27
]
},
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "5",
"_score" : null,
"_source" : {
"name" : "Rose",
"age" : 25,
"job" : "QA",
"gender" : "female",
"salary" : 18000
},
"sort" : [
25
]
}
]
}
}
},
{
"key" : "DBA",
"doc_count" : 2,
"old_employee" : {
"hits" : {
"total" : {
"value" : 2,
"relation" : "eq"
},
"max_score" : null,
"hits" : [
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "19",
"_score" : null,
"_source" : {
"name" : "Boone",
"age" : 30,
"job" : "DBA",
"gender" : "male",
"salary" : 30000
},
"sort" : [
30
]
},
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "20",
"_score" : null,
"_source" : {
"name" : "Kathy",
"age" : 29,
"job" : "DBA",
"gender" : "female",
"salary" : 20000
},
"sort" : [
29
]
}
]
}
}
},
{
"key" : "Web Designer",
"doc_count" : 2,
"old_employee" : {
"hits" : {
"total" : {
"value" : 2,
"relation" : "eq"
},
"max_score" : null,
"hits" : [
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "4",
"_score" : null,
"_source" : {
"name" : "Rivera",
"age" : 26,
"job" : "Web Designer",
"gender" : "female",
"salary" : 22000
},
"sort" : [
26
]
},
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "3",
"_score" : null,
"_source" : {
"name" : "Tran",
"age" : 25,
"job" : "Web Designer",
"gender" : "male",
"salary" : 18000
},
"sort" : [
25
]
}
]
}
}
},
{
"key" : "Dev Manager",
"doc_count" : 1,
"old_employee" : {
"hits" : {
"total" : {
"value" : 1,
"relation" : "eq"
},
"max_score" : null,
"hits" : [
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "2",
"_score" : null,
"_source" : {
"name" : "Underwood",
"age" : 41,
"job" : "Dev Manager",
"gender" : "male",
"salary" : 50000
},
"sort" : [
41
]
}
]
}
}
},
{
"key" : "Product Manager",
"doc_count" : 1,
"old_employee" : {
"hits" : {
"total" : {
"value" : 1,
"relation" : "eq"
},
"max_score" : null,
"hits" : [
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "1",
"_score" : null,
"_source" : {
"name" : "Emma",
"age" : 32,
"job" : "Product Manager",
"gender" : "female",
"salary" : 35000
},
"sort" : [
32
]
}
]
}
}
}
]
}
}
}
Ranges 分桶,可以自己定义 key
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"salary_range": {
"range": {
"field":"salary",
"ranges":[
{
"to":10000
},
{
"from":10000,
"to":20000
},
{
"key":">20000",
"from":20000
}
]
}
}
}
}
- 返回
{
"took" : 9,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"salary_range" : {
"buckets" : [
{
"key" : "*-10000.0",
"to" : 10000.0,
"doc_count" : 1
},
{
"key" : "10000.0-20000.0",
"from" : 10000.0,
"to" : 20000.0,
"doc_count" : 4
},
{
"key" : ">20000",
"from" : 20000.0,
"doc_count" : 15
}
]
}
}
}
Histogram,工资0到10万,以 5000一个区间进行分桶
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"salary_histrogram": {
"histogram": {
"field":"salary",
"interval":5000,
"extended_bounds":{
"min":0,
"max":100000
}
}
}
}
}
- 返回
{
"took" : 4,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"salary_histrogram" : {
"buckets" : [
{
"key" : 0.0,
"doc_count" : 0
},
{
"key" : 5000.0,
"doc_count" : 1
},
{
"key" : 10000.0,
"doc_count" : 0
},
{
"key" : 15000.0,
"doc_count" : 4
},
{
"key" : 20000.0,
"doc_count" : 6
},
{
"key" : 25000.0,
"doc_count" : 3
},
{
"key" : 30000.0,
"doc_count" : 3
},
{
"key" : 35000.0,
"doc_count" : 2
},
{
"key" : 40000.0,
"doc_count" : 0
},
{
"key" : 45000.0,
"doc_count" : 0
},
{
"key" : 50000.0,
"doc_count" : 1
},
{
"key" : 55000.0,
"doc_count" : 0
},
{
"key" : 60000.0,
"doc_count" : 0
},
{
"key" : 65000.0,
"doc_count" : 0
},
{
"key" : 70000.0,
"doc_count" : 0
},
{
"key" : 75000.0,
"doc_count" : 0
},
{
"key" : 80000.0,
"doc_count" : 0
},
{
"key" : 85000.0,
"doc_count" : 0
},
{
"key" : 90000.0,
"doc_count" : 0
},
{
"key" : 95000.0,
"doc_count" : 0
},
{
"key" : 100000.0,
"doc_count" : 0
}
]
}
}
}
嵌套聚合,按照工作类型分桶,并统计工资信息(max group by)
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"Job_salary_stats": {
"terms": {
"field": "job.keyword"
},
"aggs": {
"salary": {
"stats": {
"field": "salary"
}
}
}
}
}
}
- 返回
{
"took" : 20,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"Job_salary_stats" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Java Programmer",
"doc_count" : 7,
"salary" : {
"count" : 7,
"min" : 9000.0,
"max" : 38000.0,
"avg" : 25571.428571428572,
"sum" : 179000.0
}
},
{
"key" : "Javascript Programmer",
"doc_count" : 4,
"salary" : {
"count" : 4,
"min" : 16000.0,
"max" : 25000.0,
"avg" : 19250.0,
"sum" : 77000.0
}
},
{
"key" : "QA",
"doc_count" : 3,
"salary" : {
"count" : 3,
"min" : 18000.0,
"max" : 25000.0,
"avg" : 21000.0,
"sum" : 63000.0
}
},
{
"key" : "DBA",
"doc_count" : 2,
"salary" : {
"count" : 2,
"min" : 20000.0,
"max" : 30000.0,
"avg" : 25000.0,
"sum" : 50000.0
}
},
{
"key" : "Web Designer",
"doc_count" : 2,
"salary" : {
"count" : 2,
"min" : 18000.0,
"max" : 22000.0,
"avg" : 20000.0,
"sum" : 40000.0
}
},
{
"key" : "Dev Manager",
"doc_count" : 1,
"salary" : {
"count" : 1,
"min" : 50000.0,
"max" : 50000.0,
"avg" : 50000.0,
"sum" : 50000.0
}
},
{
"key" : "Product Manager",
"doc_count" : 1,
"salary" : {
"count" : 1,
"min" : 35000.0,
"max" : 35000.0,
"avg" : 35000.0,
"sum" : 35000.0
}
}
]
}
}
}
多次嵌套。根据工作类型分桶,然后按照性别分桶,计算工资的统计信息
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"Job_gender_stats": {
"terms": {
"field": "job.keyword"
},
"aggs": {
"gender_stats": {
"terms": {
"field": "gender"
},
"aggs": {
"salary_stats": {
"stats": {
"field": "salary"
}
}
}
}
}
}
}
}
- 返回
{
"took" : 13,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"Job_gender_stats" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Java Programmer",
"doc_count" : 7,
"gender_stats" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "male",
"doc_count" : 5,
"salary_stats" : {
"count" : 5,
"min" : 9000.0,
"max" : 32000.0,
"avg" : 22200.0,
"sum" : 111000.0
}
},
{
"key" : "female",
"doc_count" : 2,
"salary_stats" : {
"count" : 2,
"min" : 30000.0,
"max" : 38000.0,
"avg" : 34000.0,
"sum" : 68000.0
}
}
]
}
},
{
"key" : "Javascript Programmer",
"doc_count" : 4,
"gender_stats" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "male",
"doc_count" : 3,
"salary_stats" : {
"count" : 3,
"min" : 16000.0,
"max" : 25000.0,
"avg" : 19000.0,
"sum" : 57000.0
}
},
{
"key" : "female",
"doc_count" : 1,
"salary_stats" : {
"count" : 1,
"min" : 20000.0,
"max" : 20000.0,
"avg" : 20000.0,
"sum" : 20000.0
}
}
]
}
},
{
"key" : "QA",
"doc_count" : 3,
"gender_stats" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "female",
"doc_count" : 2,
"salary_stats" : {
"count" : 2,
"min" : 18000.0,
"max" : 25000.0,
"avg" : 21500.0,
"sum" : 43000.0
}
},
{
"key" : "male",
"doc_count" : 1,
"salary_stats" : {
"count" : 1,
"min" : 20000.0,
"max" : 20000.0,
"avg" : 20000.0,
"sum" : 20000.0
}
}
]
}
},
{
"key" : "DBA",
"doc_count" : 2,
"gender_stats" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "female",
"doc_count" : 1,
"salary_stats" : {
"count" : 1,
"min" : 20000.0,
"max" : 20000.0,
"avg" : 20000.0,
"sum" : 20000.0
}
},
{
"key" : "male",
"doc_count" : 1,
"salary_stats" : {
"count" : 1,
"min" : 30000.0,
"max" : 30000.0,
"avg" : 30000.0,
"sum" : 30000.0
}
}
]
}
},
{
"key" : "Web Designer",
"doc_count" : 2,
"gender_stats" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "female",
"doc_count" : 1,
"salary_stats" : {
"count" : 1,
"min" : 22000.0,
"max" : 22000.0,
"avg" : 22000.0,
"sum" : 22000.0
}
},
{
"key" : "male",
"doc_count" : 1,
"salary_stats" : {
"count" : 1,
"min" : 18000.0,
"max" : 18000.0,
"avg" : 18000.0,
"sum" : 18000.0
}
}
]
}
},
{
"key" : "Dev Manager",
"doc_count" : 1,
"gender_stats" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "male",
"doc_count" : 1,
"salary_stats" : {
"count" : 1,
"min" : 50000.0,
"max" : 50000.0,
"avg" : 50000.0,
"sum" : 50000.0
}
}
]
}
},
{
"key" : "Product Manager",
"doc_count" : 1,
"gender_stats" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "female",
"doc_count" : 1,
"salary_stats" : {
"count" : 1,
"min" : 35000.0,
"max" : 35000.0,
"avg" : 35000.0,
"sum" : 35000.0
}
}
]
}
}
]
}
}
}
Pipeline
pipeline概念:支持对聚合分析的结果,再次进行聚合分析。
Pipeline 的分析结果会输出到原结果中,根据位置的不同,分为两类:
- Silbing - 结果和现有分析结果同级
Max,Min,Avg & Sum Bucket
Stats,Extended Stats Bucket
Percentile Bucket - Parent - 结果内嵌到现有结果
Dervative(求导)
Cumultive Sum(累计求和)
Moving Window(滑动窗口)
平均工资最低的工作类型
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field": "job.keyword",
"size": 10
},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
}
}
},
"min_salary_by_job":{
"min_bucket": {
"buckets_path": "jobs>avg_salary"
}
}
}
}
- 返回
{
"took" : 3,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"jobs" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Java Programmer",
"doc_count" : 7,
"avg_salary" : {
"value" : 25571.428571428572
}
},
{
"key" : "Javascript Programmer",
"doc_count" : 4,
"avg_salary" : {
"value" : 19250.0
}
},
{
"key" : "QA",
"doc_count" : 3,
"avg_salary" : {
"value" : 21000.0
}
},
{
"key" : "DBA",
"doc_count" : 2,
"avg_salary" : {
"value" : 25000.0
}
},
{
"key" : "Web Designer",
"doc_count" : 2,
"avg_salary" : {
"value" : 20000.0
}
},
{
"key" : "Dev Manager",
"doc_count" : 1,
"avg_salary" : {
"value" : 50000.0
}
},
{
"key" : "Product Manager",
"doc_count" : 1,
"avg_salary" : {
"value" : 35000.0
}
}
]
},
"min_salary_by_job" : {
"value" : 19250.0,
"keys" : [
"Javascript Programmer"
]
}
}
}
平均工资最高的工作类型
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field": "job.keyword",
"size": 10
},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
}
}
},
"max_salary_by_job":{
"max_bucket": {
"buckets_path": "jobs>avg_salary"
}
}
}
}
- 返回
{
"took" : 6,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"jobs" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Java Programmer",
"doc_count" : 7,
"avg_salary" : {
"value" : 25571.428571428572
}
},
{
"key" : "Javascript Programmer",
"doc_count" : 4,
"avg_salary" : {
"value" : 19250.0
}
},
{
"key" : "QA",
"doc_count" : 3,
"avg_salary" : {
"value" : 21000.0
}
},
{
"key" : "DBA",
"doc_count" : 2,
"avg_salary" : {
"value" : 25000.0
}
},
{
"key" : "Web Designer",
"doc_count" : 2,
"avg_salary" : {
"value" : 20000.0
}
},
{
"key" : "Dev Manager",
"doc_count" : 1,
"avg_salary" : {
"value" : 50000.0
}
},
{
"key" : "Product Manager",
"doc_count" : 1,
"avg_salary" : {
"value" : 35000.0
}
}
]
},
"max_salary_by_job" : {
"value" : 50000.0,
"keys" : [
"Dev Manager"
]
}
}
}
平均工资的平均工资
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field": "job.keyword",
"size": 10
},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
}
}
},
"avg_salary_by_job":{
"avg_bucket": {
"buckets_path": "jobs>avg_salary"
}
}
}
}
- 返回
{
"took" : 9,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"jobs" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Java Programmer",
"doc_count" : 7,
"avg_salary" : {
"value" : 25571.428571428572
}
},
{
"key" : "Javascript Programmer",
"doc_count" : 4,
"avg_salary" : {
"value" : 19250.0
}
},
{
"key" : "QA",
"doc_count" : 3,
"avg_salary" : {
"value" : 21000.0
}
},
{
"key" : "DBA",
"doc_count" : 2,
"avg_salary" : {
"value" : 25000.0
}
},
{
"key" : "Web Designer",
"doc_count" : 2,
"avg_salary" : {
"value" : 20000.0
}
},
{
"key" : "Dev Manager",
"doc_count" : 1,
"avg_salary" : {
"value" : 50000.0
}
},
{
"key" : "Product Manager",
"doc_count" : 1,
"avg_salary" : {
"value" : 35000.0
}
}
]
},
"avg_salary_by_job" : {
"value" : 27974.48979591837
}
}
}
平均工资的统计分析
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field": "job.keyword",
"size": 10
},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
}
}
},
"stats_salary_by_job":{
"stats_bucket": {
"buckets_path": "jobs>avg_salary"
}
}
}
}
- 返回
{
"took" : 3,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"jobs" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Java Programmer",
"doc_count" : 7,
"avg_salary" : {
"value" : 25571.428571428572
}
},
{
"key" : "Javascript Programmer",
"doc_count" : 4,
"avg_salary" : {
"value" : 19250.0
}
},
{
"key" : "QA",
"doc_count" : 3,
"avg_salary" : {
"value" : 21000.0
}
},
{
"key" : "DBA",
"doc_count" : 2,
"avg_salary" : {
"value" : 25000.0
}
},
{
"key" : "Web Designer",
"doc_count" : 2,
"avg_salary" : {
"value" : 20000.0
}
},
{
"key" : "Dev Manager",
"doc_count" : 1,
"avg_salary" : {
"value" : 50000.0
}
},
{
"key" : "Product Manager",
"doc_count" : 1,
"avg_salary" : {
"value" : 35000.0
}
}
]
},
"stats_salary_by_job" : {
"count" : 7,
"min" : 19250.0,
"max" : 50000.0,
"avg" : 27974.48979591837,
"sum" : 195821.42857142858
}
}
}
平均工资的百分位数
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field": "job.keyword",
"size": 10
},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
}
}
},
"percentiles_salary_by_job":{
"percentiles_bucket": {
"buckets_path": "jobs>avg_salary"
}
}
}
- 返回
{
"took" : 10,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"jobs" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Java Programmer",
"doc_count" : 7,
"avg_salary" : {
"value" : 25571.428571428572
}
},
{
"key" : "Javascript Programmer",
"doc_count" : 4,
"avg_salary" : {
"value" : 19250.0
}
},
{
"key" : "QA",
"doc_count" : 3,
"avg_salary" : {
"value" : 21000.0
}
},
{
"key" : "DBA",
"doc_count" : 2,
"avg_salary" : {
"value" : 25000.0
}
},
{
"key" : "Web Designer",
"doc_count" : 2,
"avg_salary" : {
"value" : 20000.0
}
},
{
"key" : "Dev Manager",
"doc_count" : 1,
"avg_salary" : {
"value" : 50000.0
}
},
{
"key" : "Product Manager",
"doc_count" : 1,
"avg_salary" : {
"value" : 35000.0
}
}
]
},
"percentiles_salary_by_job" : {
"values" : {
"1.0" : 19250.0,
"5.0" : 19250.0,
"25.0" : 21000.0,
"50.0" : 25000.0,
"75.0" : 35000.0,
"95.0" : 50000.0,
"99.0" : 50000.0
}
}
}
}
按照年龄对平均工资求导
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"age": {
"histogram": {
"field": "age",
"min_doc_count": 1,
"interval": 1
},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
},
"derivative_avg_salary":{
"derivative": {
"buckets_path": "avg_salary"
}
}
}
}
}
}
- 返回
{
"took" : 31,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"age" : {
"buckets" : [
{
"key" : 20.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 9000.0
}
},
{
"key" : 21.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 16000.0
},
"derivative_avg_salary" : {
"value" : 7000.0
}
},
{
"key" : 25.0,
"doc_count" : 3,
"avg_salary" : {
"value" : 17333.333333333332
},
"derivative_avg_salary" : {
"value" : 1333.3333333333321
}
},
{
"key" : 26.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 22000.0
},
"derivative_avg_salary" : {
"value" : 4666.666666666668
}
},
{
"key" : 27.0,
"doc_count" : 2,
"avg_salary" : {
"value" : 20000.0
},
"derivative_avg_salary" : {
"value" : -2000.0
}
},
{
"key" : 29.0,
"doc_count" : 2,
"avg_salary" : {
"value" : 20000.0
},
"derivative_avg_salary" : {
"value" : 0.0
}
},
{
"key" : 30.0,
"doc_count" : 2,
"avg_salary" : {
"value" : 30000.0
},
"derivative_avg_salary" : {
"value" : 10000.0
}
},
{
"key" : 31.0,
"doc_count" : 2,
"avg_salary" : {
"value" : 28500.0
},
"derivative_avg_salary" : {
"value" : -1500.0
}
},
{
"key" : 32.0,
"doc_count" : 3,
"avg_salary" : {
"value" : 27333.333333333332
},
"derivative_avg_salary" : {
"value" : -1166.6666666666679
}
},
{
"key" : 33.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 28000.0
},
"derivative_avg_salary" : {
"value" : 666.6666666666679
}
},
{
"key" : 36.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 38000.0
},
"derivative_avg_salary" : {
"value" : 10000.0
}
},
{
"key" : 41.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 50000.0
},
"derivative_avg_salary" : {
"value" : 12000.0
}
}
]
}
}
}
累计求和
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"age": {
"histogram": {
"field": "age",
"min_doc_count": 1,
"interval": 1
},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
},
"cumulative_salary":{
"cumulative_sum": {
"buckets_path": "avg_salary"
}
}
}
}
}
}
- 返回
{
"took" : 3,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"age" : {
"buckets" : [
{
"key" : 20.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 9000.0
},
"cumulative_salary" : {
"value" : 9000.0
}
},
{
"key" : 21.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 16000.0
},
"cumulative_salary" : {
"value" : 25000.0
}
},
{
"key" : 25.0,
"doc_count" : 3,
"avg_salary" : {
"value" : 17333.333333333332
},
"cumulative_salary" : {
"value" : 42333.33333333333
}
},
{
"key" : 26.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 22000.0
},
"cumulative_salary" : {
"value" : 64333.33333333333
}
},
{
"key" : 27.0,
"doc_count" : 2,
"avg_salary" : {
"value" : 20000.0
},
"cumulative_salary" : {
"value" : 84333.33333333333
}
},
{
"key" : 29.0,
"doc_count" : 2,
"avg_salary" : {
"value" : 20000.0
},
"cumulative_salary" : {
"value" : 104333.33333333333
}
},
{
"key" : 30.0,
"doc_count" : 2,
"avg_salary" : {
"value" : 30000.0
},
"cumulative_salary" : {
"value" : 134333.3333333333
}
},
{
"key" : 31.0,
"doc_count" : 2,
"avg_salary" : {
"value" : 28500.0
},
"cumulative_salary" : {
"value" : 162833.3333333333
}
},
{
"key" : 32.0,
"doc_count" : 3,
"avg_salary" : {
"value" : 27333.333333333332
},
"cumulative_salary" : {
"value" : 190166.66666666666
}
},
{
"key" : 33.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 28000.0
},
"cumulative_salary" : {
"value" : 218166.66666666666
}
},
{
"key" : 36.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 38000.0
},
"cumulative_salary" : {
"value" : 256166.66666666666
}
},
{
"key" : 41.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 50000.0
},
"cumulative_salary" : {
"value" : 306166.6666666666
}
}
]
}
}
}
滑动窗口
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"age": {
"histogram": {
"field": "age",
"min_doc_count": 1,
"interval": 1
},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
},
"moving_avg_salary":{
"moving_fn": {
"buckets_path": "avg_salary",
"window":10,
"script": "MovingFunctions.min(values)"
}
}
}
}
}
}
- 返回
{
"took" : 3,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"age" : {
"buckets" : [
{
"key" : 20.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 9000.0
},
"moving_avg_salary" : {
"value" : null
}
},
{
"key" : 21.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 16000.0
},
"moving_avg_salary" : {
"value" : 9000.0
}
},
{
"key" : 25.0,
"doc_count" : 3,
"avg_salary" : {
"value" : 17333.333333333332
},
"moving_avg_salary" : {
"value" : 9000.0
}
},
{
"key" : 26.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 22000.0
},
"moving_avg_salary" : {
"value" : 9000.0
}
},
{
"key" : 27.0,
"doc_count" : 2,
"avg_salary" : {
"value" : 20000.0
},
"moving_avg_salary" : {
"value" : 9000.0
}
},
{
"key" : 29.0,
"doc_count" : 2,
"avg_salary" : {
"value" : 20000.0
},
"moving_avg_salary" : {
"value" : 9000.0
}
},
{
"key" : 30.0,
"doc_count" : 2,
"avg_salary" : {
"value" : 30000.0
},
"moving_avg_salary" : {
"value" : 9000.0
}
},
{
"key" : 31.0,
"doc_count" : 2,
"avg_salary" : {
"value" : 28500.0
},
"moving_avg_salary" : {
"value" : 9000.0
}
},
{
"key" : 32.0,
"doc_count" : 3,
"avg_salary" : {
"value" : 27333.333333333332
},
"moving_avg_salary" : {
"value" : 9000.0
}
},
{
"key" : 33.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 28000.0
},
"moving_avg_salary" : {
"value" : 9000.0
}
},
{
"key" : 36.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 38000.0
},
"moving_avg_salary" : {
"value" : 9000.0
}
},
{
"key" : 41.0,
"doc_count" : 1,
"avg_salary" : {
"value" : 50000.0
},
"moving_avg_salary" : {
"value" : 16000.0
}
}
]
}
}
}
作用范围
ES 聚合分析的默认作用范围时query的查询结果集,但也支持以下方式改变聚合作用范围。
1.Filter
2.Post Filter
3.Global
Filter
只过滤聚合的结果集,不过滤query 的结果集。
- 请求
POST employees/_search
{
"size": 0,
"aggs": {
"older_person": {
"filter":{
"range":{
"age":{
"from":35
}
}
},
"aggs":{
"jobs":{
"terms": {
"field":"job.keyword"
}
}
}},
"all_jobs": {
"terms": {
"field":"job.keyword"
}
}
}
}
- 返回
{
"took" : 10,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 20,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"older_person" : {
"doc_count" : 2,
"jobs" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Dev Manager",
"doc_count" : 1
},
{
"key" : "Java Programmer",
"doc_count" : 1
}
]
}
},
"all_jobs" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Java Programmer",
"doc_count" : 7
},
{
"key" : "Javascript Programmer",
"doc_count" : 4
},
{
"key" : "QA",
"doc_count" : 3
},
{
"key" : "DBA",
"doc_count" : 2
},
{
"key" : "Web Designer",
"doc_count" : 2
},
{
"key" : "Dev Manager",
"doc_count" : 1
},
{
"key" : "Product Manager",
"doc_count" : 1
}
]
}
}
}
Post field. 一条语句,找出所有的job类型。还能找到聚合后符合条件的结果
只过滤 query 的结果集,不过滤聚合的结果集。
- 请求
POST employees/_search
{
"aggs": {
"jobs": {
"terms": {
"field": "job.keyword"
}
}
},
"post_filter": {
"match": {
"job.keyword": "Dev Manager"
}
}
}
- 返回
{
"took" : 22,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 1,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "employees",
"_type" : "_doc",
"_id" : "2",
"_score" : 1.0,
"_source" : {
"name" : "Underwood",
"age" : 41,
"job" : "Dev Manager",
"gender" : "male",
"salary" : 50000
}
}
]
},
"aggregations" : {
"jobs" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Java Programmer",
"doc_count" : 7
},
{
"key" : "Javascript Programmer",
"doc_count" : 4
},
{
"key" : "QA",
"doc_count" : 3
},
{
"key" : "DBA",
"doc_count" : 2
},
{
"key" : "Web Designer",
"doc_count" : 2
},
{
"key" : "Dev Manager",
"doc_count" : 1
},
{
"key" : "Product Manager",
"doc_count" : 1
}
]
}
}
}
性能考量:post_filter会在查询之后才会被执行,因此会失去过滤在性能上帮助(比如缓存)。因此post_filter应该只和聚合一起使用,并且仅当你使用了不同的过滤条件时。
global
全局聚合,不受 query 作用域的影响。
- 请求
POST employees/_search
{
"size": 0,
"query": {
"range": {
"age": {
"gte": 40
}
}
},
"aggs": {
"jobs": {
"terms": {
"field":"job.keyword"
}
},
"all":{
"global":{},
"aggs":{
"salary_avg":{
"avg":{
"field":"salary"
}
}
}
}
}
}
- 返回
{
"took" : 30,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 1,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"all" : {
"doc_count" : 20,
"salary_avg" : {
"value" : 24700.0
}
},
"jobs" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "Dev Manager",
"doc_count" : 1
}
]
}
}
}