Elasticsearch 聚合 - 奇客谷教程

Elasticsearch 教程

相关推荐

Elasticsearch 聚合


聚合提供了对数据进行分组、统计的能力,类似于SQL中GROUP by和SQL聚合函数。在Elasticsearch中,可以同时返回搜索结果及其聚合计算结果,这是非常强大和高效的。

下面的例子,对所有帐户按所在州分组,统计每组账户数量,然后返回前10个条目,按账户数量降序排列:

API

GET /bank/_search
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword"
      }
    }
  }
}

复制

CURL

curl -X GET "localhost:9200/bank/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword"
      }
    }
  }
}
'

复制

上述命令与以下SQL语句意义相同:

SELECT state, COUNT(*) FROM bank GROUP BY state ORDER BY COUNT(*) DESC LIMIT 10;

复制

响应:

{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1000,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "group_by_state" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 743,
      "buckets" : [
        {
          "key" : "TX",
          "doc_count" : 30
        },
        {
          "key" : "MD",
          "doc_count" : 28
        },
        {
          "key" : "ID",
          "doc_count" : 27
        },
        {
          "key" : "AL",
          "doc_count" : 25
        },
        {
          "key" : "ME",
          "doc_count" : 25
        },
        {
          "key" : "TN",
          "doc_count" : 25
        },
        {
          "key" : "WY",
          "doc_count" : 25
        },
        {
          "key" : "DC",
          "doc_count" : 24
        },
        {
          "key" : "MA",
          "doc_count" : 24
        },
        {
          "key" : "ND",
          "doc_count" : 24
        }
      ]
    }
  }
}

复制

可以看到ID(爱达荷州)有27个帐户,其次是TX(德克萨斯州)的27个帐户,然后是AL(阿拉巴马州)的25个帐户,等等。

注意,size=0表示不显示搜索结果,我们只想看到聚合结果。

基于前面例子的结果,下面例子同时按州计算平均帐户余额,然后返回前10个条目,按账户数量降序排列:

API

GET /bank/_search
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword"
      },
      "aggs": {
        "average_balance": {
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  }
}

复制

CURL

curl -X GET "localhost:9200/bank/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword"
      },
      "aggs": {
        "average_balance": {
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  }
}
'

复制

注意,average_balance聚合嵌入在group_by_state聚合中,这是聚合的常见模式,可以在聚合中任意嵌套聚合。

基于前面例子的结果,对结果按平均账户余额降序排序:

API

GET /bank/_search
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword",
        "order": {
          "average_balance": "desc"
        }
      },
      "aggs": {
        "average_balance": {
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  }
}

复制

CURL

curl -X GET "localhost:9200/bank/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword",
        "order": {
          "average_balance": "desc"
        }
      },
      "aggs": {
        "average_balance": {
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  }
}
'

复制

下面例子按照年龄段(20-29岁,30-39岁,40-49岁)分组,然后按性别分组,统计每个年龄等级,每种性别的平均账户余额:

API

GET /bank/_search
{
  "size": 0,
  "aggs": {
    "group_by_age": {
      "range": {
        "field": "age",
        "ranges": [
          {
            "from": 20,
            "to": 30
          },
          {
            "from": 30,
            "to": 40
          },
          {
            "from": 40,
            "to": 50
          }
        ]
      },
      "aggs": {
        "group_by_gender": {
          "terms": {
            "field": "gender.keyword"
          },
          "aggs": {
            "average_balance": {
              "avg": {
                "field": "balance"
              }
            }
          }
        }
      }
    }
  }
}

复制

CURL

curl -X GET "localhost:9200/bank/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "group_by_age": {
      "range": {
        "field": "age",
        "ranges": [
          {
            "from": 20,
            "to": 30
          },
          {
            "from": 30,
            "to": 40
          },
          {
            "from": 40,
            "to": 50
          }
        ]
      },
      "aggs": {
        "group_by_gender": {
          "terms": {
            "field": "gender.keyword"
          },
          "aggs": {
            "average_balance": {
              "avg": {
                "field": "balance"
              }
            }
          }
        }
      }
    }
  }
}
'

复制

还有许多其他聚合功能,不再赘述,可参考聚合参考指南


Doc navigation

← Elasticsearch 过滤

  • 0
    点赞
  • 1
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
很抱歉,Elasticsearch当前最新版本为7.15.1,没有8.8.1版本。以下是Elasticsearch 7.15.1的详细安装教程: 1. 下载Elasticsearch 在官网 https://www.elastic.co/cn/downloads/elasticsearch 下载Elasticsearch的压缩包,选择适合自己操作系统的版本。下载完成后解压到任意目录。 2. 修改配置文件 进入Elasticsearch的config目录,修改elasticsearch.yml文件。比如: ``` # 设置集群名称 cluster.name: my-cluster # 设置节点名称 node.name: my-node # 设置数据存储路径 path.data: /path/to/data # 设置日志文件路径 path.logs: /path/to/logs ``` 3. 启动Elasticsearch 在终端中进入Elasticsearch的bin目录,执行以下命令启动Elasticsearch: ``` ./elasticsearch ``` 如果一切顺利,你应该能看到类似以下的输出: ``` [2021-10-20T14:12:18,394][INFO ][o.e.n.Node ] [my-node] version[7.15.1], pid[12345], build[default/tar/123abc/2021-10-11T22:34:29.218660Z], OS[Linux/4.14.143-89.123.amzn1.x86_64/amd64], JVM[AdoptOpenJDK/OpenJDK 64-Bit Server VM/16.0.2/16.0.2+7] [2021-10-20T14:12:18,396][INFO ][o.e.n.Node ] [my-node] JVM arguments [-Xms1g, -Xmx1g, -XX:+UseG1GC, -XX:G1ReservePercent=25, -XX:InitiatingHeapOccupancyPercent=30, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -Djdk.io.permissionsUseCanonicalPath=true, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.locale.providers=SPI,COMPAT, -Xms512m, -Xmx512m, -Des.path.home=/path/to/elasticsearch-7.15.1, -Des.path.conf=/path/to/elasticsearch-7.15.1/config, -Des.distribution.flavor=default, -Des.distribution.type=tar, -Des.bundled_jdk=true] [2021-10-20T14:12:19,999][INFO ][o.e.p.PluginsService ] [my-node] loaded module [aggs-matrix-stats] [2021-10-20T14:12:19,999][INFO ][o.e.p.PluginsService ] [my-node] loaded module [analysis-common] [2021-10-20T14:12:19,999][INFO ][o.e.p.PluginsService ] [my-node] loaded module [geo] [2021-10-20T14:12:19,999][INFO ][o.e.p.PluginsService ] [my-node] loaded module [ingest-common] ... [2021-10-20T14:12:20,000][INFO ][o.e.p.PluginsService ] [my-node] loaded module [transport-netty4] [2021-10-20T14:12:20,000][INFO ][o.e.p.PluginsService ] [my-node] no plugins loaded [2021-10-20T14:12:23,123][INFO ][o.e.x.s.a.s.FileRolesStore] [my-node] parsed [0] roles from file [/path/to/elasticsearch-7.15.1/config/roles.yml] [2021-10-20T14:12:24,456][INFO ][o.e.i.g.GatewayService ] [my-node] recovered [0] indices into cluster_state [2021-10-20T14:12:27,521][INFO ][o.e.c.r.a.AllocationService] [my-node] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[my-index][0]]]). ``` 这表示Elasticsearch已经成功启动。你可以通过访问`http://localhost:9200`来验证Elasticsearch是否运行正常。 4. 安装插件 Elasticsearch提供了很多插件,可以根据自己的需求进行安装。比如,安装kopf插件: ``` ./bin/elasticsearch-plugin install lmenezes/elasticsearch-kopf/2.1.2 ``` 5. 配置Elasticsearch作为服务 如果你想将Elasticsearch作为服务在后台运行,可以参考官方文档:https://www.elastic.co/guide/en/elasticsearch/reference/current/starting-elasticsearch.html。 希望这个安装教程能够帮助到你。

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值