Elasticsearch 聚合查询

  • Bucket Aggregation:一些列满足特定条件的文档的集合;
  • Metric Aggregation:一些数学运算,可以对文档字段进行统计分析;
    1.会基于数据集计算结果,除了支持在字段上进行计算,同样也支持在脚本(painless script)产生的结果之上进行计算;
    2.大多数Metric是数学计算,仅输出一个值:min/max/sum/avg/cardinality;
    3.部分metric支持输出多个值:stats/percentiles/percentile_ranks。
  • Pipeline Aggregation:对其他的聚合结果进行二次聚合;
  • Matrix Aggregation:支持对多个字段的操作并提供一个结果矩阵。

Bucket & Metric 聚合

aggs语法

{
  "size": 0,
  "aggs": { // 与query同级的关键词
    "": { // 自定义的聚合名字
      "": { // 聚合的定义:不同的Type + Body
        
      },
      "aggs": {} // 子聚合查询
    },
    "" : {} // 可以包含多个同级的聚合查询
  }
}

Metric

一些系列的统计方法,例如count(),min()等。

  • 单值分析:只输出一个分析结果:
    min、max、avg、sum;
    Cardinality(类似于distinct Count)。
  • 多值分析:输出多个分析结果:
    stats、extended stats;
    percentile、percentile rank;
    top hits。

demo索引

PUT /employees/
{
  "mappings" : {
      "properties" : {
        "age" : {
          "type" : "integer"
        },
        "gender" : {
          "type" : "keyword"
        },
        "job" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 50
            }
          }
        },
        "name" : {
          "type" : "keyword"
        },
        "salary" : {
          "type" : "integer"
        }
      }
    }
}

Metric 聚合,找到最低的工资

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "min_salary": {
      "min": {
        "field":"salary"
      }
    }
  }
}
  • 返回
{
  "took" : 5,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "min_salary" : {
      "value" : 9000.0
    }
  }
}

Metric 聚合,找到最高的工资

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "max_salary": {
      "max": {
        "field":"salary"
      }
    }
  }
}
  • 返回
{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "max_salary" : {
      "value" : 50000.0
    }
  }
}

多个 Metric 聚合,找到最低最高和平均工资

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "max_salary": {
      "max": {
        "field": "salary"
      }
    },
    "min_salary": {
      "min": {
        "field": "salary"
      }
    },
    "avg_salary": {
      "avg": {
        "field": "salary"
      }
    }
  }
}
  • 返回
{
  "took" : 5,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "max_salary" : {
      "value" : 50000.0
    },
    "avg_salary" : {
      "value" : 24700.0
    },
    "min_salary" : {
      "value" : 9000.0
    }
  }
}

一个聚合,输出多值

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "stats_salary": {
      "stats": {
        "field":"salary"
      }
    }
  }
}
  • 返回
{
  "took" : 4,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "stats_salary" : {
      "count" : 20,
      "min" : 9000.0,
      "max" : 50000.0,
      "avg" : 24700.0,
      "sum" : 494000.0
    }
  }
}

百分位数

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "percentiles_salary": {
      "percentiles": {
        "field":"salary"
      }
    }
  }
}
  • 返回
{
  "took" : 14,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "percentiles_salary" : {
      "values" : {
        "1.0" : 9000.0,
        "5.0" : 12500.0,
        "25.0" : 19000.0,
        "50.0" : 22000.0,
        "75.0" : 30000.0,
        "95.0" : 44000.0,
        "99.0" : 50000.0
      }
    }
  }
}

百分比排位

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "percentiles_salary": {
      "percentile_ranks": {
        "field":"salary",
        "values": [30000]
      }
    }
  }
}
  • 返回
{
  "took" : 4,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "percentiles_salary" : {
      "values" : {
        "30000.0" : 75.0
      }
    }
  }
}

distinct count

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "gender_count": {
      "cardinality": {
        "field":"gender"
      }
    }
  }
}
  • 返回
{
  "took" : 13,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "gender_count" : {
      "value" : 2
    }
  }
}

Bucket

按照一定规则,将文档分配到不同的桶中,从而达到分类的目的。

  • Terms (相当于 group by)
  • 数字类型:Range/ Data Range、Histogram/ Data Histogram

也支持嵌套,就是在桶里面再做分桶。

对keword类型字段 进行聚合

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "jobs": {
      "terms": {
        "field":"job.keyword"
      }
    }
  }
}
  • 返回
{
  "took" : 17,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "jobs" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "Java Programmer",
          "doc_count" : 7
        },
        {
          "key" : "Javascript Programmer",
          "doc_count" : 4
        },
        {
          "key" : "QA",
          "doc_count" : 3
        },
        {
          "key" : "DBA",
          "doc_count" : 2
        },
        {
          "key" : "Web Designer",
          "doc_count" : 2
        },
        {
          "key" : "Dev Manager",
          "doc_count" : 1
        },
        {
          "key" : "Product Manager",
          "doc_count" : 1
        }
      ]
    }
  }
}

对 Text 字段进行 terms 分词。分词后的terms

  • 请求
// 对 Text 字段打开 fielddata,支持terms aggregation
PUT employees/_mapping
{
  "properties" : {
    "job":{
       "type":     "text",
       "fielddata": true
    }
  }
}

POST employees/_search
{
  "size": 0,
  "aggs": {
    "jobs": {
      "terms": {
        "field":"job"
      }
    }
  }
}
  • 返回
{
  "took" : 4,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "jobs" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "programmer",
          "doc_count" : 11
        },
        {
          "key" : "java",
          "doc_count" : 7
        },
        {
          "key" : "javascript",
          "doc_count" : 4
        },
        {
          "key" : "qa",
          "doc_count" : 3
        },
        {
          "key" : "dba",
          "doc_count" : 2
        },
        {
          "key" : "designer",
          "doc_count" : 2
        },
        {
          "key" : "manager",
          "doc_count" : 2
        },
        {
          "key" : "web",
          "doc_count" : 2
        },
        {
          "key" : "dev",
          "doc_count" : 1
        },
        {
          "key" : "product",
          "doc_count" : 1
        }
      ]
    }
  }
}

指定 bucket 的 size

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "ages_5": {
      "terms": {
        "field":"age",
        "size":3
      }
    }
  }
}
  • 返回
{
  "took" : 8,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "ages_5" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 12,
      "buckets" : [
        {
          "key" : 25,
          "doc_count" : 3
        },
        {
          "key" : 32,
          "doc_count" : 3
        },
        {
          "key" : 27,
          "doc_count" : 2
        }
      ]
    }
  }
}

不同工种中,年纪最大的3个员工的具体信息 top hits

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "jobs": {
      "terms": {
        "field":"job.keyword"
      },
      "aggs":{
        "old_employee":{
          "top_hits":{
            "size":3,
            "sort":[
              {
                "age":{
                  "order":"desc"
                }
              }
            ]
          }
        }
      }
    }
  }
}
  • 返回
{
  "took" : 13,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "jobs" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "Java Programmer",
          "doc_count" : 7,
          "old_employee" : {
            "hits" : {
              "total" : {
                "value" : 7,
                "relation" : "eq"
              },
              "max_score" : null,
              "hits" : [
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "11",
                  "_score" : null,
                  "_source" : {
                    "name" : "Jenny",
                    "age" : 36,
                    "job" : "Java Programmer",
                    "gender" : "female",
                    "salary" : 38000
                  },
                  "sort" : [
                    36
                  ]
                },
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "15",
                  "_score" : null,
                  "_source" : {
                    "name" : "King",
                    "age" : 33,
                    "job" : "Java Programmer",
                    "gender" : "male",
                    "salary" : 28000
                  },
                  "sort" : [
                    33
                  ]
                },
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "9",
                  "_score" : null,
                  "_source" : {
                    "name" : "Gregory",
                    "age" : 32,
                    "job" : "Java Programmer",
                    "gender" : "male",
                    "salary" : 22000
                  },
                  "sort" : [
                    32
                  ]
                }
              ]
            }
          }
        },
        {
          "key" : "Javascript Programmer",
          "doc_count" : 4,
          "old_employee" : {
            "hits" : {
              "total" : {
                "value" : 4,
                "relation" : "eq"
              },
              "max_score" : null,
              "hits" : [
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "14",
                  "_score" : null,
                  "_source" : {
                    "name" : "Marshall",
                    "age" : 32,
                    "job" : "Javascript Programmer",
                    "gender" : "male",
                    "salary" : 25000
                  },
                  "sort" : [
                    32
                  ]
                },
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "18",
                  "_score" : null,
                  "_source" : {
                    "name" : "Catherine",
                    "age" : 29,
                    "job" : "Javascript Programmer",
                    "gender" : "female",
                    "salary" : 20000
                  },
                  "sort" : [
                    29
                  ]
                },
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "17",
                  "_score" : null,
                  "_source" : {
                    "name" : "Goodwin",
                    "age" : 25,
                    "job" : "Javascript Programmer",
                    "gender" : "male",
                    "salary" : 16000
                  },
                  "sort" : [
                    25
                  ]
                }
              ]
            }
          }
        },
        {
          "key" : "QA",
          "doc_count" : 3,
          "old_employee" : {
            "hits" : {
              "total" : {
                "value" : 3,
                "relation" : "eq"
              },
              "max_score" : null,
              "hits" : [
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "6",
                  "_score" : null,
                  "_source" : {
                    "name" : "Lucy",
                    "age" : 31,
                    "job" : "QA",
                    "gender" : "female",
                    "salary" : 25000
                  },
                  "sort" : [
                    31
                  ]
                },
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "7",
                  "_score" : null,
                  "_source" : {
                    "name" : "Byrd",
                    "age" : 27,
                    "job" : "QA",
                    "gender" : "male",
                    "salary" : 20000
                  },
                  "sort" : [
                    27
                  ]
                },
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "5",
                  "_score" : null,
                  "_source" : {
                    "name" : "Rose",
                    "age" : 25,
                    "job" : "QA",
                    "gender" : "female",
                    "salary" : 18000
                  },
                  "sort" : [
                    25
                  ]
                }
              ]
            }
          }
        },
        {
          "key" : "DBA",
          "doc_count" : 2,
          "old_employee" : {
            "hits" : {
              "total" : {
                "value" : 2,
                "relation" : "eq"
              },
              "max_score" : null,
              "hits" : [
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "19",
                  "_score" : null,
                  "_source" : {
                    "name" : "Boone",
                    "age" : 30,
                    "job" : "DBA",
                    "gender" : "male",
                    "salary" : 30000
                  },
                  "sort" : [
                    30
                  ]
                },
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "20",
                  "_score" : null,
                  "_source" : {
                    "name" : "Kathy",
                    "age" : 29,
                    "job" : "DBA",
                    "gender" : "female",
                    "salary" : 20000
                  },
                  "sort" : [
                    29
                  ]
                }
              ]
            }
          }
        },
        {
          "key" : "Web Designer",
          "doc_count" : 2,
          "old_employee" : {
            "hits" : {
              "total" : {
                "value" : 2,
                "relation" : "eq"
              },
              "max_score" : null,
              "hits" : [
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "4",
                  "_score" : null,
                  "_source" : {
                    "name" : "Rivera",
                    "age" : 26,
                    "job" : "Web Designer",
                    "gender" : "female",
                    "salary" : 22000
                  },
                  "sort" : [
                    26
                  ]
                },
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "3",
                  "_score" : null,
                  "_source" : {
                    "name" : "Tran",
                    "age" : 25,
                    "job" : "Web Designer",
                    "gender" : "male",
                    "salary" : 18000
                  },
                  "sort" : [
                    25
                  ]
                }
              ]
            }
          }
        },
        {
          "key" : "Dev Manager",
          "doc_count" : 1,
          "old_employee" : {
            "hits" : {
              "total" : {
                "value" : 1,
                "relation" : "eq"
              },
              "max_score" : null,
              "hits" : [
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "2",
                  "_score" : null,
                  "_source" : {
                    "name" : "Underwood",
                    "age" : 41,
                    "job" : "Dev Manager",
                    "gender" : "male",
                    "salary" : 50000
                  },
                  "sort" : [
                    41
                  ]
                }
              ]
            }
          }
        },
        {
          "key" : "Product Manager",
          "doc_count" : 1,
          "old_employee" : {
            "hits" : {
              "total" : {
                "value" : 1,
                "relation" : "eq"
              },
              "max_score" : null,
              "hits" : [
                {
                  "_index" : "employees",
                  "_type" : "_doc",
                  "_id" : "1",
                  "_score" : null,
                  "_source" : {
                    "name" : "Emma",
                    "age" : 32,
                    "job" : "Product Manager",
                    "gender" : "female",
                    "salary" : 35000
                  },
                  "sort" : [
                    32
                  ]
                }
              ]
            }
          }
        }
      ]
    }
  }
}

Ranges 分桶,可以自己定义 key

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "salary_range": {
      "range": {
        "field":"salary",
        "ranges":[
          {
            "to":10000
          },
          {
            "from":10000,
            "to":20000
          },
          {
            "key":">20000",
            "from":20000
          }
        ]
      }
    }
  }
}
  • 返回
{
  "took" : 9,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "salary_range" : {
      "buckets" : [
        {
          "key" : "*-10000.0",
          "to" : 10000.0,
          "doc_count" : 1
        },
        {
          "key" : "10000.0-20000.0",
          "from" : 10000.0,
          "to" : 20000.0,
          "doc_count" : 4
        },
        {
          "key" : ">20000",
          "from" : 20000.0,
          "doc_count" : 15
        }
      ]
    }
  }
}

Histogram,工资0到10万,以 5000一个区间进行分桶

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "salary_histrogram": {
      "histogram": {
        "field":"salary",
        "interval":5000,
        "extended_bounds":{
          "min":0,
          "max":100000

        }
      }
    }
  }
}
  • 返回
{
  "took" : 4,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "salary_histrogram" : {
      "buckets" : [
        {
          "key" : 0.0,
          "doc_count" : 0
        },
        {
          "key" : 5000.0,
          "doc_count" : 1
        },
        {
          "key" : 10000.0,
          "doc_count" : 0
        },
        {
          "key" : 15000.0,
          "doc_count" : 4
        },
        {
          "key" : 20000.0,
          "doc_count" : 6
        },
        {
          "key" : 25000.0,
          "doc_count" : 3
        },
        {
          "key" : 30000.0,
          "doc_count" : 3
        },
        {
          "key" : 35000.0,
          "doc_count" : 2
        },
        {
          "key" : 40000.0,
          "doc_count" : 0
        },
        {
          "key" : 45000.0,
          "doc_count" : 0
        },
        {
          "key" : 50000.0,
          "doc_count" : 1
        },
        {
          "key" : 55000.0,
          "doc_count" : 0
        },
        {
          "key" : 60000.0,
          "doc_count" : 0
        },
        {
          "key" : 65000.0,
          "doc_count" : 0
        },
        {
          "key" : 70000.0,
          "doc_count" : 0
        },
        {
          "key" : 75000.0,
          "doc_count" : 0
        },
        {
          "key" : 80000.0,
          "doc_count" : 0
        },
        {
          "key" : 85000.0,
          "doc_count" : 0
        },
        {
          "key" : 90000.0,
          "doc_count" : 0
        },
        {
          "key" : 95000.0,
          "doc_count" : 0
        },
        {
          "key" : 100000.0,
          "doc_count" : 0
        }
      ]
    }
  }
}

嵌套聚合,按照工作类型分桶,并统计工资信息(max group by)

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "Job_salary_stats": {
      "terms": {
        "field": "job.keyword"
      },
      "aggs": {
        "salary": {
          "stats": {
            "field": "salary"
          }
        }
      }
    }
  }
}
  • 返回
{
  "took" : 20,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "Job_salary_stats" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "Java Programmer",
          "doc_count" : 7,
          "salary" : {
            "count" : 7,
            "min" : 9000.0,
            "max" : 38000.0,
            "avg" : 25571.428571428572,
            "sum" : 179000.0
          }
        },
        {
          "key" : "Javascript Programmer",
          "doc_count" : 4,
          "salary" : {
            "count" : 4,
            "min" : 16000.0,
            "max" : 25000.0,
            "avg" : 19250.0,
            "sum" : 77000.0
          }
        },
        {
          "key" : "QA",
          "doc_count" : 3,
          "salary" : {
            "count" : 3,
            "min" : 18000.0,
            "max" : 25000.0,
            "avg" : 21000.0,
            "sum" : 63000.0
          }
        },
        {
          "key" : "DBA",
          "doc_count" : 2,
          "salary" : {
            "count" : 2,
            "min" : 20000.0,
            "max" : 30000.0,
            "avg" : 25000.0,
            "sum" : 50000.0
          }
        },
        {
          "key" : "Web Designer",
          "doc_count" : 2,
          "salary" : {
            "count" : 2,
            "min" : 18000.0,
            "max" : 22000.0,
            "avg" : 20000.0,
            "sum" : 40000.0
          }
        },
        {
          "key" : "Dev Manager",
          "doc_count" : 1,
          "salary" : {
            "count" : 1,
            "min" : 50000.0,
            "max" : 50000.0,
            "avg" : 50000.0,
            "sum" : 50000.0
          }
        },
        {
          "key" : "Product Manager",
          "doc_count" : 1,
          "salary" : {
            "count" : 1,
            "min" : 35000.0,
            "max" : 35000.0,
            "avg" : 35000.0,
            "sum" : 35000.0
          }
        }
      ]
    }
  }
}

多次嵌套。根据工作类型分桶,然后按照性别分桶,计算工资的统计信息

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "Job_gender_stats": {
      "terms": {
        "field": "job.keyword"
      },
      "aggs": {
        "gender_stats": {
          "terms": {
            "field": "gender"
          },
          "aggs": {
            "salary_stats": {
              "stats": {
                "field": "salary"
              }
            }
          }
        }
      }
    }
  }
}
  • 返回
{
  "took" : 13,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "Job_gender_stats" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "Java Programmer",
          "doc_count" : 7,
          "gender_stats" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "male",
                "doc_count" : 5,
                "salary_stats" : {
                  "count" : 5,
                  "min" : 9000.0,
                  "max" : 32000.0,
                  "avg" : 22200.0,
                  "sum" : 111000.0
                }
              },
              {
                "key" : "female",
                "doc_count" : 2,
                "salary_stats" : {
                  "count" : 2,
                  "min" : 30000.0,
                  "max" : 38000.0,
                  "avg" : 34000.0,
                  "sum" : 68000.0
                }
              }
            ]
          }
        },
        {
          "key" : "Javascript Programmer",
          "doc_count" : 4,
          "gender_stats" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "male",
                "doc_count" : 3,
                "salary_stats" : {
                  "count" : 3,
                  "min" : 16000.0,
                  "max" : 25000.0,
                  "avg" : 19000.0,
                  "sum" : 57000.0
                }
              },
              {
                "key" : "female",
                "doc_count" : 1,
                "salary_stats" : {
                  "count" : 1,
                  "min" : 20000.0,
                  "max" : 20000.0,
                  "avg" : 20000.0,
                  "sum" : 20000.0
                }
              }
            ]
          }
        },
        {
          "key" : "QA",
          "doc_count" : 3,
          "gender_stats" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "female",
                "doc_count" : 2,
                "salary_stats" : {
                  "count" : 2,
                  "min" : 18000.0,
                  "max" : 25000.0,
                  "avg" : 21500.0,
                  "sum" : 43000.0
                }
              },
              {
                "key" : "male",
                "doc_count" : 1,
                "salary_stats" : {
                  "count" : 1,
                  "min" : 20000.0,
                  "max" : 20000.0,
                  "avg" : 20000.0,
                  "sum" : 20000.0
                }
              }
            ]
          }
        },
        {
          "key" : "DBA",
          "doc_count" : 2,
          "gender_stats" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "female",
                "doc_count" : 1,
                "salary_stats" : {
                  "count" : 1,
                  "min" : 20000.0,
                  "max" : 20000.0,
                  "avg" : 20000.0,
                  "sum" : 20000.0
                }
              },
              {
                "key" : "male",
                "doc_count" : 1,
                "salary_stats" : {
                  "count" : 1,
                  "min" : 30000.0,
                  "max" : 30000.0,
                  "avg" : 30000.0,
                  "sum" : 30000.0
                }
              }
            ]
          }
        },
        {
          "key" : "Web Designer",
          "doc_count" : 2,
          "gender_stats" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "female",
                "doc_count" : 1,
                "salary_stats" : {
                  "count" : 1,
                  "min" : 22000.0,
                  "max" : 22000.0,
                  "avg" : 22000.0,
                  "sum" : 22000.0
                }
              },
              {
                "key" : "male",
                "doc_count" : 1,
                "salary_stats" : {
                  "count" : 1,
                  "min" : 18000.0,
                  "max" : 18000.0,
                  "avg" : 18000.0,
                  "sum" : 18000.0
                }
              }
            ]
          }
        },
        {
          "key" : "Dev Manager",
          "doc_count" : 1,
          "gender_stats" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "male",
                "doc_count" : 1,
                "salary_stats" : {
                  "count" : 1,
                  "min" : 50000.0,
                  "max" : 50000.0,
                  "avg" : 50000.0,
                  "sum" : 50000.0
                }
              }
            ]
          }
        },
        {
          "key" : "Product Manager",
          "doc_count" : 1,
          "gender_stats" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "female",
                "doc_count" : 1,
                "salary_stats" : {
                  "count" : 1,
                  "min" : 35000.0,
                  "max" : 35000.0,
                  "avg" : 35000.0,
                  "sum" : 35000.0
                }
              }
            ]
          }
        }
      ]
    }
  }
}

Pipeline

pipeline概念:支持对聚合分析的结果,再次进行聚合分析。

Pipeline 的分析结果会输出到原结果中,根据位置的不同,分为两类:

  1. Silbing - 结果和现有分析结果同级
    Max,Min,Avg & Sum Bucket
    Stats,Extended Stats Bucket
    Percentile Bucket
  2. Parent - 结果内嵌到现有结果
    Dervative(求导)
    Cumultive Sum(累计求和)
    Moving Window(滑动窗口)

平均工资最低的工作类型

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "jobs": {
      "terms": {
        "field": "job.keyword",
        "size": 10
      },
      "aggs": {
        "avg_salary": {
          "avg": {
            "field": "salary"
          }
        }
      }
    },
    "min_salary_by_job":{
      "min_bucket": {
        "buckets_path": "jobs>avg_salary"
      }
    }
  }
}
  • 返回
{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "jobs" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "Java Programmer",
          "doc_count" : 7,
          "avg_salary" : {
            "value" : 25571.428571428572
          }
        },
        {
          "key" : "Javascript Programmer",
          "doc_count" : 4,
          "avg_salary" : {
            "value" : 19250.0
          }
        },
        {
          "key" : "QA",
          "doc_count" : 3,
          "avg_salary" : {
            "value" : 21000.0
          }
        },
        {
          "key" : "DBA",
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 25000.0
          }
        },
        {
          "key" : "Web Designer",
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 20000.0
          }
        },
        {
          "key" : "Dev Manager",
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 50000.0
          }
        },
        {
          "key" : "Product Manager",
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 35000.0
          }
        }
      ]
    },
    "min_salary_by_job" : {
      "value" : 19250.0,
      "keys" : [
        "Javascript Programmer"
      ]
    }
  }
}

平均工资最高的工作类型

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "jobs": {
      "terms": {
        "field": "job.keyword",
        "size": 10
      },
      "aggs": {
        "avg_salary": {
          "avg": {
            "field": "salary"
          }
        }
      }
    },
    "max_salary_by_job":{
      "max_bucket": {
        "buckets_path": "jobs>avg_salary"
      }
    }
  }
}
  • 返回
{
  "took" : 6,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "jobs" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "Java Programmer",
          "doc_count" : 7,
          "avg_salary" : {
            "value" : 25571.428571428572
          }
        },
        {
          "key" : "Javascript Programmer",
          "doc_count" : 4,
          "avg_salary" : {
            "value" : 19250.0
          }
        },
        {
          "key" : "QA",
          "doc_count" : 3,
          "avg_salary" : {
            "value" : 21000.0
          }
        },
        {
          "key" : "DBA",
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 25000.0
          }
        },
        {
          "key" : "Web Designer",
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 20000.0
          }
        },
        {
          "key" : "Dev Manager",
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 50000.0
          }
        },
        {
          "key" : "Product Manager",
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 35000.0
          }
        }
      ]
    },
    "max_salary_by_job" : {
      "value" : 50000.0,
      "keys" : [
        "Dev Manager"
      ]
    }
  }
}

平均工资的平均工资

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "jobs": {
      "terms": {
        "field": "job.keyword",
        "size": 10
      },
      "aggs": {
        "avg_salary": {
          "avg": {
            "field": "salary"
          }
        }
      }
    },
    "avg_salary_by_job":{
      "avg_bucket": {
        "buckets_path": "jobs>avg_salary"
      }
    }
  }
}
  • 返回
{
  "took" : 9,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "jobs" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "Java Programmer",
          "doc_count" : 7,
          "avg_salary" : {
            "value" : 25571.428571428572
          }
        },
        {
          "key" : "Javascript Programmer",
          "doc_count" : 4,
          "avg_salary" : {
            "value" : 19250.0
          }
        },
        {
          "key" : "QA",
          "doc_count" : 3,
          "avg_salary" : {
            "value" : 21000.0
          }
        },
        {
          "key" : "DBA",
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 25000.0
          }
        },
        {
          "key" : "Web Designer",
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 20000.0
          }
        },
        {
          "key" : "Dev Manager",
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 50000.0
          }
        },
        {
          "key" : "Product Manager",
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 35000.0
          }
        }
      ]
    },
    "avg_salary_by_job" : {
      "value" : 27974.48979591837
    }
  }
}

平均工资的统计分析

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "jobs": {
      "terms": {
        "field": "job.keyword",
        "size": 10
      },
      "aggs": {
        "avg_salary": {
          "avg": {
            "field": "salary"
          }
        }
      }
    },
    "stats_salary_by_job":{
      "stats_bucket": {
        "buckets_path": "jobs>avg_salary"
      }
    }
  }
}
  • 返回
{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "jobs" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "Java Programmer",
          "doc_count" : 7,
          "avg_salary" : {
            "value" : 25571.428571428572
          }
        },
        {
          "key" : "Javascript Programmer",
          "doc_count" : 4,
          "avg_salary" : {
            "value" : 19250.0
          }
        },
        {
          "key" : "QA",
          "doc_count" : 3,
          "avg_salary" : {
            "value" : 21000.0
          }
        },
        {
          "key" : "DBA",
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 25000.0
          }
        },
        {
          "key" : "Web Designer",
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 20000.0
          }
        },
        {
          "key" : "Dev Manager",
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 50000.0
          }
        },
        {
          "key" : "Product Manager",
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 35000.0
          }
        }
      ]
    },
    "stats_salary_by_job" : {
      "count" : 7,
      "min" : 19250.0,
      "max" : 50000.0,
      "avg" : 27974.48979591837,
      "sum" : 195821.42857142858
    }
  }
}

平均工资的百分位数

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "jobs": {
      "terms": {
        "field": "job.keyword",
        "size": 10
      },
      "aggs": {
        "avg_salary": {
          "avg": {
            "field": "salary"
          }
        }
      }
    },
    "percentiles_salary_by_job":{
      "percentiles_bucket": {
        "buckets_path": "jobs>avg_salary"
      }
    }
  }
  • 返回
{
  "took" : 10,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "jobs" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "Java Programmer",
          "doc_count" : 7,
          "avg_salary" : {
            "value" : 25571.428571428572
          }
        },
        {
          "key" : "Javascript Programmer",
          "doc_count" : 4,
          "avg_salary" : {
            "value" : 19250.0
          }
        },
        {
          "key" : "QA",
          "doc_count" : 3,
          "avg_salary" : {
            "value" : 21000.0
          }
        },
        {
          "key" : "DBA",
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 25000.0
          }
        },
        {
          "key" : "Web Designer",
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 20000.0
          }
        },
        {
          "key" : "Dev Manager",
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 50000.0
          }
        },
        {
          "key" : "Product Manager",
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 35000.0
          }
        }
      ]
    },
    "percentiles_salary_by_job" : {
      "values" : {
        "1.0" : 19250.0,
        "5.0" : 19250.0,
        "25.0" : 21000.0,
        "50.0" : 25000.0,
        "75.0" : 35000.0,
        "95.0" : 50000.0,
        "99.0" : 50000.0
      }
    }
  }
}

按照年龄对平均工资求导

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "age": {
      "histogram": {
        "field": "age",
        "min_doc_count": 1,
        "interval": 1
      },
      "aggs": {
        "avg_salary": {
          "avg": {
            "field": "salary"
          }
        },
        "derivative_avg_salary":{
          "derivative": {
            "buckets_path": "avg_salary"
          }
        }
      }
    }
  }
}
  • 返回
{
  "took" : 31,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "age" : {
      "buckets" : [
        {
          "key" : 20.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 9000.0
          }
        },
        {
          "key" : 21.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 16000.0
          },
          "derivative_avg_salary" : {
            "value" : 7000.0
          }
        },
        {
          "key" : 25.0,
          "doc_count" : 3,
          "avg_salary" : {
            "value" : 17333.333333333332
          },
          "derivative_avg_salary" : {
            "value" : 1333.3333333333321
          }
        },
        {
          "key" : 26.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 22000.0
          },
          "derivative_avg_salary" : {
            "value" : 4666.666666666668
          }
        },
        {
          "key" : 27.0,
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 20000.0
          },
          "derivative_avg_salary" : {
            "value" : -2000.0
          }
        },
        {
          "key" : 29.0,
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 20000.0
          },
          "derivative_avg_salary" : {
            "value" : 0.0
          }
        },
        {
          "key" : 30.0,
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 30000.0
          },
          "derivative_avg_salary" : {
            "value" : 10000.0
          }
        },
        {
          "key" : 31.0,
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 28500.0
          },
          "derivative_avg_salary" : {
            "value" : -1500.0
          }
        },
        {
          "key" : 32.0,
          "doc_count" : 3,
          "avg_salary" : {
            "value" : 27333.333333333332
          },
          "derivative_avg_salary" : {
            "value" : -1166.6666666666679
          }
        },
        {
          "key" : 33.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 28000.0
          },
          "derivative_avg_salary" : {
            "value" : 666.6666666666679
          }
        },
        {
          "key" : 36.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 38000.0
          },
          "derivative_avg_salary" : {
            "value" : 10000.0
          }
        },
        {
          "key" : 41.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 50000.0
          },
          "derivative_avg_salary" : {
            "value" : 12000.0
          }
        }
      ]
    }
  }
}

累计求和

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "age": {
      "histogram": {
        "field": "age",
        "min_doc_count": 1,
        "interval": 1
      },
      "aggs": {
        "avg_salary": {
          "avg": {
            "field": "salary"
          }
        },
        "cumulative_salary":{
          "cumulative_sum": {
            "buckets_path": "avg_salary"
          }
        }
      }
    }
  }
}
  • 返回
{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "age" : {
      "buckets" : [
        {
          "key" : 20.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 9000.0
          },
          "cumulative_salary" : {
            "value" : 9000.0
          }
        },
        {
          "key" : 21.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 16000.0
          },
          "cumulative_salary" : {
            "value" : 25000.0
          }
        },
        {
          "key" : 25.0,
          "doc_count" : 3,
          "avg_salary" : {
            "value" : 17333.333333333332
          },
          "cumulative_salary" : {
            "value" : 42333.33333333333
          }
        },
        {
          "key" : 26.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 22000.0
          },
          "cumulative_salary" : {
            "value" : 64333.33333333333
          }
        },
        {
          "key" : 27.0,
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 20000.0
          },
          "cumulative_salary" : {
            "value" : 84333.33333333333
          }
        },
        {
          "key" : 29.0,
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 20000.0
          },
          "cumulative_salary" : {
            "value" : 104333.33333333333
          }
        },
        {
          "key" : 30.0,
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 30000.0
          },
          "cumulative_salary" : {
            "value" : 134333.3333333333
          }
        },
        {
          "key" : 31.0,
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 28500.0
          },
          "cumulative_salary" : {
            "value" : 162833.3333333333
          }
        },
        {
          "key" : 32.0,
          "doc_count" : 3,
          "avg_salary" : {
            "value" : 27333.333333333332
          },
          "cumulative_salary" : {
            "value" : 190166.66666666666
          }
        },
        {
          "key" : 33.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 28000.0
          },
          "cumulative_salary" : {
            "value" : 218166.66666666666
          }
        },
        {
          "key" : 36.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 38000.0
          },
          "cumulative_salary" : {
            "value" : 256166.66666666666
          }
        },
        {
          "key" : 41.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 50000.0
          },
          "cumulative_salary" : {
            "value" : 306166.6666666666
          }
        }
      ]
    }
  }
}

滑动窗口

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "age": {
      "histogram": {
        "field": "age",
        "min_doc_count": 1,
        "interval": 1
      },
      "aggs": {
        "avg_salary": {
          "avg": {
            "field": "salary"
          }
        },
        "moving_avg_salary":{
          "moving_fn": {
            "buckets_path": "avg_salary",
            "window":10,
            "script": "MovingFunctions.min(values)"
          }
        }
      }
    }
  }
}
  • 返回
{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "age" : {
      "buckets" : [
        {
          "key" : 20.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 9000.0
          },
          "moving_avg_salary" : {
            "value" : null
          }
        },
        {
          "key" : 21.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 16000.0
          },
          "moving_avg_salary" : {
            "value" : 9000.0
          }
        },
        {
          "key" : 25.0,
          "doc_count" : 3,
          "avg_salary" : {
            "value" : 17333.333333333332
          },
          "moving_avg_salary" : {
            "value" : 9000.0
          }
        },
        {
          "key" : 26.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 22000.0
          },
          "moving_avg_salary" : {
            "value" : 9000.0
          }
        },
        {
          "key" : 27.0,
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 20000.0
          },
          "moving_avg_salary" : {
            "value" : 9000.0
          }
        },
        {
          "key" : 29.0,
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 20000.0
          },
          "moving_avg_salary" : {
            "value" : 9000.0
          }
        },
        {
          "key" : 30.0,
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 30000.0
          },
          "moving_avg_salary" : {
            "value" : 9000.0
          }
        },
        {
          "key" : 31.0,
          "doc_count" : 2,
          "avg_salary" : {
            "value" : 28500.0
          },
          "moving_avg_salary" : {
            "value" : 9000.0
          }
        },
        {
          "key" : 32.0,
          "doc_count" : 3,
          "avg_salary" : {
            "value" : 27333.333333333332
          },
          "moving_avg_salary" : {
            "value" : 9000.0
          }
        },
        {
          "key" : 33.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 28000.0
          },
          "moving_avg_salary" : {
            "value" : 9000.0
          }
        },
        {
          "key" : 36.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 38000.0
          },
          "moving_avg_salary" : {
            "value" : 9000.0
          }
        },
        {
          "key" : 41.0,
          "doc_count" : 1,
          "avg_salary" : {
            "value" : 50000.0
          },
          "moving_avg_salary" : {
            "value" : 16000.0
          }
        }
      ]
    }
  }
}

作用范围

ES 聚合分析的默认作用范围时query的查询结果集,但也支持以下方式改变聚合作用范围。

1.Filter
2.Post Filter
3.Global

Filter

只过滤聚合的结果集,不过滤query 的结果集。

  • 请求
POST employees/_search
{
  "size": 0,
  "aggs": {
    "older_person": {
      "filter":{
        "range":{
          "age":{
            "from":35
          }
        }
      },
      "aggs":{
         "jobs":{
           "terms": {
        "field":"job.keyword"
      }
      }
    }},
    "all_jobs": {
      "terms": {
        "field":"job.keyword"
        
      }
    }
  }
}
  • 返回
{
  "took" : 10,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 20,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "older_person" : {
      "doc_count" : 2,
      "jobs" : {
        "doc_count_error_upper_bound" : 0,
        "sum_other_doc_count" : 0,
        "buckets" : [
          {
            "key" : "Dev Manager",
            "doc_count" : 1
          },
          {
            "key" : "Java Programmer",
            "doc_count" : 1
          }
        ]
      }
    },
    "all_jobs" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "Java Programmer",
          "doc_count" : 7
        },
        {
          "key" : "Javascript Programmer",
          "doc_count" : 4
        },
        {
          "key" : "QA",
          "doc_count" : 3
        },
        {
          "key" : "DBA",
          "doc_count" : 2
        },
        {
          "key" : "Web Designer",
          "doc_count" : 2
        },
        {
          "key" : "Dev Manager",
          "doc_count" : 1
        },
        {
          "key" : "Product Manager",
          "doc_count" : 1
        }
      ]
    }
  }
}

Post field. 一条语句,找出所有的job类型。还能找到聚合后符合条件的结果

只过滤 query 的结果集,不过滤聚合的结果集。

  • 请求
POST employees/_search
{
  "aggs": {
    "jobs": {
      "terms": {
        "field": "job.keyword"
      }
    }
  },
  "post_filter": {
    "match": {
      "job.keyword": "Dev Manager"
    }
  }
}
  • 返回
{
  "took" : 22,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "employees",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 1.0,
        "_source" : {
          "name" : "Underwood",
          "age" : 41,
          "job" : "Dev Manager",
          "gender" : "male",
          "salary" : 50000
        }
      }
    ]
  },
  "aggregations" : {
    "jobs" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "Java Programmer",
          "doc_count" : 7
        },
        {
          "key" : "Javascript Programmer",
          "doc_count" : 4
        },
        {
          "key" : "QA",
          "doc_count" : 3
        },
        {
          "key" : "DBA",
          "doc_count" : 2
        },
        {
          "key" : "Web Designer",
          "doc_count" : 2
        },
        {
          "key" : "Dev Manager",
          "doc_count" : 1
        },
        {
          "key" : "Product Manager",
          "doc_count" : 1
        }
      ]
    }
  }
}

性能考量:post_filter会在查询之后才会被执行,因此会失去过滤在性能上帮助(比如缓存)。因此post_filter应该只和聚合一起使用,并且仅当你使用了不同的过滤条件时。

global

全局聚合,不受 query 作用域的影响。

  • 请求
POST employees/_search
{
  "size": 0,
  "query": {
    "range": {
      "age": {
        "gte": 40
      }
    }
  },
  "aggs": {
    "jobs": {
      "terms": {
        "field":"job.keyword"
        
      }
    },
    
    "all":{
      "global":{},
      "aggs":{
        "salary_avg":{
          "avg":{
            "field":"salary"
          }
        }
      }
    }
  }
}
  • 返回
{
  "took" : 30,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "all" : {
      "doc_count" : 20,
      "salary_avg" : {
        "value" : 24700.0
      }
    },
    "jobs" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "Dev Manager",
          "doc_count" : 1
        }
      ]
    }
  }
}

你可能感兴趣的:(Elasticsearch 聚合查询)