ElasticSearch-聚合bucket

DELETE cars
PUT cars
{
  "mappings": {
    "transactions": {
      "properties": {
        "price": {
          "type":"long"
        },
        "color": {
          "type":"keyword"
        },
        "make": {
          "type":"keyword"
        },
        "sold": {
          "type":"date"
        }
      }
    }
  }
}

POST /cars/transactions/_bulk
{ "index": {}}
{ "price" : 10000, "color" : "red", "make" : "honda", "sold" : "2014-10-28" }
{ "index": {}}
{ "price" : 20000, "color" : "red", "make" : "honda", "sold" : "2014-11-05" }
{ "index": {}}
{ "price" : 30000, "color" : "green", "make" : "ford", "sold" : "2014-05-18" }
{ "index": {}}
{ "price" : 15000, "color" : "blue", "make" : "toyota", "sold" : "2014-07-02" }
{ "index": {}}
{ "price" : 12000, "color" : "green", "make" : "toyota", "sold" : "2014-08-19" }
{ "index": {}}
{ "price" : 20000, "color" : "red", "make" : "honda", "sold" : "2014-11-05" }
{ "index": {}}
{ "price" : 80000, "color" : "red", "make" : "bmw", "sold" : "2014-01-01" }
{ "index": {}}
{ "price" : 25000, "color" : "blue", "make" : "ford", "sold" : "2014-02-12" }

----------Filter Aggregation-------

红色车的数量

POST /cars/transactions/_search?size=0
{
    "aggs" : {
        "red_cars" : {
            "filter" : { "term": { "color": "red" } }
        }
    }
}

----------Filters Aggregation-------

统计红色车、蓝色车各多少个

POST /cars/transactions/_search
{
  "size": 0,
  "aggs" : {
    "cars" : {
      "filters" : {
        "filters" : {
          "red_cars" :   { "match" : { "color" : "red"   }},
          "blue_cars" : { "match" : { "color" : "blue" }}
        }
      }
    }
  }
}

统计红色车、蓝色车各多少个，并计算两种颜色车的平均价格

POST /cars/transactions/_search
{
  "size": 0,
  "aggs" : {
    "cars" : {
      "filters" : {
        "filters" : {
          "red_cars" :   { "match" : { "color" : "red"   }},
          "blue_cars" : { "match" : { "color" : "blue" }}
        }
      },
      "aggs" : {
          "avg_price" : { "avg" : { "field" : "price" } }
      }
    }
  }
}

----------Date Histogram Aggregation-------

每月销售多少台汽车

interval参数: year, quarter, month, week, day, hour, minute, second
interval参数：还可以写具体的时间，比如24h,90m

GET /cars/transactions/_search
{
   "size" : 0,
   "aggs": {
      "sales_over_time": {
         "date_histogram": {
            "field": "sold",
            "interval": "month", 
            "format": "yyyy-MM-dd" 
         }
      }
   }
}

指定周期90分钟

GET /cars/transactions/_search
{
   "size" : 0,
   "aggs": {
      "sales_over_time": {
         "date_histogram": {
            "field": "sold",
            "interval": "90m", 
            "format": "yyyy-MM-dd HH:mm:ss" 
         }
      }
   }
}

加入keyed参数,使返回的buckets不作为一个数组返回

GET /cars/transactions/_search
{
   "size" : 0,
   "aggs": {
      "sales_over_time": {
         "date_histogram": {
            "field": "sold",
            "interval": "month", 
            "format": "yyyy-MM-dd",
            "keyed":true
         }
      }
   }
}

----------Date Range Aggregation-------

按照售卖日期范围统计车辆数量

GET /cars/transactions/_search
{
  "size": 0,
  "aggs": {
    "range": {
      "date_range": {
        "field": "sold",
        "format": "yyyy-MM-dd",
        "ranges": [
          {"from": "now-36M/M"},
          {"to": "now-24M/M"},
          {"from": "now-36M/M","to": "now-12M/M"}
        ]
      }
    }
  }
}

加入keyed参数,使返回的buckets不作为一个数组返回，并指定key值

GET /cars/transactions/_search
{
  "size": 0,
  "aggs": {
    "range": {
      "date_range": {
        "field": "sold",
        "format": "yyyy-MM-dd",
        "ranges": [
          {"from": "now-36M/M","key":"36months"},
          {"to": "now-24M/M","key":"2years_ago"},
          {"from": "now-36M/M","to": "now-12M/M"}
        ],
        "keyed":true
      }
    }
  }
}

按照售卖日期范围统计车辆数量，并计算该周期内的平均售卖价格

GET /cars/transactions/_search
{
  "size": 0,
  "aggs": {
    "range": {
      "date_range": {
        "field": "sold",
        "format": "yyyy-MM-dd",
        "ranges": [
          {"from": "now-36M/M","key":"36months"},
          {"to": "now-24M/M","key":"2years_ago"},
          {"from": "now-36M/M","to": "now-12M/M"}
        ],
        "keyed":true
      },
      "aggs" : {
          "avg_price" : { "avg" : { "field" : "price" } }
      }
    }
  }
}

----------Histogram Aggregation-------

直方图，按照20000为区间进行分桶

GET /cars/transactions/_search
{
    "size" : 0,
    "aggs" : {
        "colors" : {
            "histogram" : {
              "field" : "price",
              "interval": 20000
            }
        }
    }
}

min_doc_count参数，限制桶内至少有几个才显示

GET /cars/transactions/_search
{
    "size" : 0,
    "aggs" : {
        "colors" : {
            "histogram" : {
              "field" : "price",
              "interval": 20000,
              "min_doc_count": 1
            }
        }
    }
}

extended_bounds参数，扩展显示范围

GET /cars/transactions/_search
{
    "size" : 0,
    "aggs" : {
        "colors" : {
            "histogram" : {
              "field" : "price",
              "interval": 20000,
              "extended_bounds": {
                    "min" : 0,
                    "max" : 200000
              }
            }
        }
    }
}

增加排序,按照桶名降序

GET /cars/transactions/_search
{
    "size" : 0,
    "aggs" : {
        "colors" : {
            "histogram" : {
              "field" : "price",
              "interval": 20000,
              "order" : { "_key" : "desc" }
            }
        }
    }
}

增加排序,按照统计数量排序

GET /cars/transactions/_search
{
    "size" : 0,
    "aggs" : {
        "colors" : {
            "histogram" : {
              "field" : "price",
              "interval": 20000,
              "order" : { "_count" : "desc" }
            }
        }
    }
}

直方图，按照20000为区间进行分桶，并进行汇总

GET /cars/transactions/_search
{
   "size" : 0,
   "aggs":{
      "price":{
         "histogram":{ 
            "field": "price",
            "interval": 20000
         },
         "aggs":{
            "price_sum": {
               "sum": { 
                 "field" : "price"
               }
             }
         }
      }
   }
}

直方图，按照20000为区间进行分桶，并进行汇总

按照子聚合的指标进行排序

GET /cars/transactions/_search
{
   "size" : 0,
   "aggs":{
      "price":{
         "histogram":{ 
            "field": "price",
            "interval": 20000,
            "order":{ "price_sum.value" : "desc" }
         },
         "aggs":{
            "price_sum": {
               "sum": { 
                 "field" : "price"
               }
             }
         }
      }
   }
}

增加keyed参数

GET /cars/transactions/_search
{
   "size" : 0,
   "aggs":{
      "price":{
         "histogram":{ 
            "field": "price",
            "interval": 20000,
            "order":{ "price_sum.value" : "desc" }
            ,"keyed":true
         },
         "aggs":{
            "price_sum": {
               "sum": { 
                 "field" : "price"
               }
             }
         }
      }
   }
}

----------Terms Aggregation-------

按照某个字段的词条进行分桶

在每个分片上先获取前几个数量最多的词条，然后再整体二次重排，所以可能会有误差

GET /cars/transactions/_search
{
    "size": 0, 
    "aggs" : {
        "make_terms" : {
            "terms" : {
                "field" : "make"
            }
        }
    }
}

按照词条的字母顺序排序

GET /cars/transactions/_search
{
    "size": 0, 
    "aggs" : {
        "make_terms" : {
            "terms" : {
                "field" : "make",
                "order" : { "_term" : "asc" }
            }
        }
    }
}

min_doc_count：用于限制只提取出现次数大于多少次的词条

GET /cars/transactions/_search
{
    "size": 0, 
    "aggs" : {
        "make_terms" : {
            "terms" : {
                "field" : "make",
                "min_doc_count": 3
            }
        }
    }
}

使用脚本,进行修改field内容

GET /cars/transactions/_search
{
    "size": 0, 
    "aggs" : {
        "make_terms" : {
            "terms" : {
                "script" : {
                    "inline": "'make:'+doc['make'].value",
                    "lang": "painless"
                }
            }
        }
    }
}

同上

GET /cars/transactions/_search
{
    "size": 0, 
    "aggs" : {
        "make_terms" : {
            "terms" : {
                "field" : "make",
                "script" : {
                    "inline" : "'make: ' +_value",
                    "lang" : "painless"
                }
            }
        }
    }
}

使用正则表达式过滤词条

GET /cars/transactions/_search
{
    "size": 0, 
    "aggs" : {
        "make_terms" : {
            "terms" : {
                "field" : "make",
                "include" : ".*o.*",
                "exclude" : "f.*"
            }
        }
    }
}

使用精确指定的词条进行分桶

GET /cars/transactions/_search
{
    "size": 0, 
    "aggs" : {
        "make_terms" : {
            "terms" : {
                "field" : "make",
                 "include" : ["mazda", "honda"]
            }
        }
    }
}

----------Range Aggregation-------

按照指定的范围区间分桶，并计算数量

GET /cars/transactions/_search
{
    "size": 0, 
    "aggs" : {
        "price_ranges" : {
            "range" : {
                "field" : "price",
                "ranges" : [
                    { "to" : 20000 },
                    { "from" : 20000, "to" : 50000 },
                    { "from" : 50000 }
                ]
            }
        }
    }
}

用script脚本指定field

GET /cars/transactions/_search
{
    "size": 0, 
    "aggs" : {
        "price_ranges" : {
            "range" : {
                "script" : {
                    "lang": "painless",
                    "inline": "doc['price'].value"
                },
                "ranges" : [
                    { "to" : 20000 },
                    { "from" : 20000, "to" : 50000 },
                    { "from" : 50000 }
                ]
            }
        }
    }
}

在分桶前，通过脚本更改值

GET /cars/transactions/_search
{
    "size": 0, 
    "aggs" : {
        "price_ranges" : {
            "range" : {
                "field" :"price",
                "script" : {
                    "lang": "painless",
                    "inline": "_value * params.rate",
                    "params" : {
                        "rate" : 2.5
                    }
                },
                "ranges" : [
                    { "to" : 20000 },
                    { "from" : 20000, "to" : 50000 },
                    { "from" : 50000 }
                ]
            }
        }
    }
}

----------Global Aggregation-------

用global来计算所有的文档

GET /cars/transactions/_search?size=0
{
    "query" : {
        "match" : { "make" : "honda" }
    },
    "aggs" : {
        "all_makes" : {
            "global" : {}, 
            "aggs" : { 
                "avg_price" : { "avg" : { "field" : "price" } }
            }
        },
        "honda_make": { "avg" : { "field" : "price" } }
    }
}

验证一下global计算是否正确

GET /cars/transactions/_search?size=0
{
    "query" : {
        "match_all" : { }
    },
    "aggs" : {
        "all_make": { "avg" : { "field" : "price" } }
    }
}

----------IP Range Aggregation-------

DELETE ips
PUT ips
{
  "mappings": {
    "transactions": {
      "properties": {
        "ip": {
          "type":"ip"
        }
      }
    }
  }
}

POST /ips/doc/_bulk
{ "index": {}}
{ "ip" : "192.168.1.1"}
{ "index": {}}
{ "ip" : "192.168.1.10"}
{ "index": {}}
{ "ip" : "192.168.1.102"}
{ "index": {}}
{ "ip" : "192.168.1.150"}
{ "index": {}}
{ "ip" : "192.168.1.160"}
{ "index": {}}
{ "ip" : "192.168.1.250"}

按照指定的ip范围分桶，并统计数量

GET /ips/doc/_search
{
    "size": 0, 
    "aggs" : {
        "ip_ranges" : {
            "ip_range" : {
                "field" : "ip",
                "ranges" : [
                    {"from" : "192.168.1.1" },
                    {"to" : "192.168.2.1" },
                    {"from" : "192.168.1.1","to" : "192.168.3.200" }
                ]
            }
        }
    }
}

通过子网掩码范围分桶

192.168.1.0/24表示：192.168.1.1至192.168.1.254

192.168.2.0/25：192.168.2.1至192.168.2.126

GET /ips/doc/_search
{
    "size": 0, 
    "aggs" : {
        "ip_ranges" : {
            "ip_range" : {
                "field" : "ip",
                "ranges" : [
                    { "mask" : "192.168.1.0/24" },
                    { "mask" : "192.168.2.0/25" }
                ]
            }
        }
    }
}

加入keyed参数

GET /ips/doc/_search
{
    "size": 0, 
    "aggs" : {
        "ip_ranges" : {
            "ip_range" : {
                "field" : "ip",
                "ranges" : [
                    { "mask" : "192.168.1.0/24" },
                    { "mask" : "192.168.2.0/25" }
                ],
                "keyed": true
            }
        }
    }
}

----------Geo Distance Aggregation-------

DELETE /museums
PUT /museums
{
    "mappings": {
        "doc": {
            "properties": {
                "location": {
                    "type": "geo_point"
                }
            }
        }
    }
}

POST /museums/doc/_bulk?refresh
{"index":{"_id":1}}
{"location": "52.374081,4.912350", "name": "NEMO Science Museum"}
{"index":{"_id":2}}
{"location": "52.369219,4.901618", "name": "Museum Het Rembrandthuis"}
{"index":{"_id":3}}
{"location": "52.371667,4.914722", "name": "Nederlands Scheepvaartmuseum"}
{"index":{"_id":4}}
{"location": "51.222900,4.405200", "name": "Letterenhuis"}
{"index":{"_id":5}}
{"location": "48.861111,2.336389", "name": "Musée du Louvre"}
{"index":{"_id":6}}
{"location": "48.860000,2.327000", "name": "Musée d'Orsay"}

指定坐标点多少距离范围内的分桶文档，默认单位:m（米）

POST /museums/_search?size=0
{
    "aggs" : {
        "rings_around_amsterdam" : {
            "geo_distance" : {
                "field" : "location",
                "origin" : "52.3760, 4.894",
                "ranges" : [
                    { "to" : 100000 },
                    { "from" : 100000, "to" : 300000 },
                    { "from" : 300000 }
                ]
            }
        }
    }
}

指定单位为公里

可以使用：mi (miles英里), in (inches英寸), yd (yards码尺), km (kilometers), cm (centimeters), mm (millimeters).

POST /museums/_search?size=0
{
    "aggs" : {
        "rings_around_amsterdam" : {
            "geo_distance" : {
                "field" : "location",
                "origin" : "52.3760, 4.894",
                "unit" : "km",
                "ranges" : [
                    { "to" : 100000 },
                    { "from" : 100000, "to" : 300000 },
                    { "from" : 300000 }
                ]
            }
        }
    }
}

指定距离模式

distance_type：arc弧度（默认，精度高，计算准确），plane（性能更好，速度更快，但精度稍差）

POST /museums/_search?size=0
{
    "aggs" : {
        "rings" : {
            "geo_distance" : {
                "field" : "location",
                "origin" : "52.3760, 4.894",
                "unit" : "km",
                "distance_type" : "plane",
                "ranges" : [
                    { "to" : 100 },
                    { "from" : 100, "to" : 300 },
                    { "from" : 300 }
                ]
            }
        }
    }
}

使用keyed

POST /museums/_search?size=0
{
    "aggs" : {
        "rings_around_amsterdam" : {
            "geo_distance" : {
                "field" : "location",
                "origin" : "52.3760, 4.894",
                "ranges" : [
                    { "to" : 100000 },
                    { "from" : 100000, "to" : 300000 },
                    { "from" : 300000 }
                ],
                "keyed": true
            }
        }
    }
}
©著作权归作者所有,转载或内容合作请联系作者
  • 人面猴
    序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
    沈念sama阅读 194,319评论 5赞 459
  • 死咒
    序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
    沈念sama阅读 81,801评论 2赞 371
  • 救了他两次的神仙让他今天三更去死
    文/潘晓璐 我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
    开封第一讲书人阅读 141,567评论 0赞 319
  • 道士缉凶录：失踪的卖姜人
    文/不坏的土叔 我叫张陵，是天一观的道长。 经常有香客问我，道长，这世上最难降的妖魔是什么？ 我笑而不...
    开封第一讲书人阅读 52,156评论 1赞 263
  • 港岛之恋（遗憾婚礼）
    正文 为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
    茶点故事阅读 61,019评论 4赞 355
  • 恶毒庶女顶嫁案：这布局不是一般人想出来的
    文/花漫 我一把揭开白布。 她就那样静静地躺着，像睡着了一般。 火红的嫁衣衬着肌肤如雪。 梳的纹丝不乱的头发上，一...
    开封第一讲书人阅读 46,090评论 1赞 272
  • 城市分裂传说
    那天，我揣着相机与录音，去河边找鬼。 笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。 我是一名探鬼主播，决...
    沈念sama阅读 36,500评论 3赞 381
  • 双鸳鸯连环套：你想象不到人心有多黑
    文/苍兰香墨 我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
    开封第一讲书人阅读 35,192评论 0赞 253
  • 万荣杀人案实录
    序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
    沈念sama阅读 39,474评论 1赞 290
  • 护林员之死
    正文 独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋 以下内容为张勋视角 年9月15日...
    茶点故事阅读 34,566评论 2赞 309
  • 白月光启示录
    正文 我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。 大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
    茶点故事阅读 36,338评论 1赞 326
  • 活死人
    序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
    沈念sama阅读 32,212评论 3赞 312
  • 日本核电站爆炸内幕
    正文 年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
    茶点故事阅读 37,572评论 3赞 298
  • 男人毒药：我在死后第九天来索命
    文/蒙蒙 一、第九天 我趴在偏房一处隐蔽的房顶上张望。 院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
    开封第一讲书人阅读 28,890评论 0赞 17
  • 一桩弑父案，背后竟有这般阴谋
    文/苍兰香墨 我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。 一阵脚步声响...
    开封第一讲书人阅读 30,169评论 1赞 250
  • 情欲美人皮
    我被黑心中介骗来泰国打工， 没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。 一个月前我还...
    沈念sama阅读 41,478评论 2赞 341
  • 代替公主和亲
    正文 我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。 传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
    茶点故事阅读 40,661评论 2赞 335

推荐阅读更多精彩内容