Elasticsearch 聚合 - 奇客谷教程

Elasticsearch 教程

• Elasticsearch 基本概念
• Elasticsearch 安装
• Elasticsearch 使用集群
  • Elasticsearch 健康检查
  • Elasticsearch 列出索引
  • Elasticsearch 创建索引
  • Elasticsearch 创建和查询文档
  • Elasticsearch 删除索引
• Elasticsearch 修改数据
  • Elasticsearch 更新文档
  • Elasticsearch 删除文档
  • Elasticsearch 批处理
• Elasticsearch 搜索数据
  • Elasticsearch 搜索API
  • Elasticsearch Query DSL(查询语言)
  • Elasticsearch 搜索
  • Elasticsearch 过滤
  • Elasticsearch 聚合

相关推荐

• ELK 教程

Elasticsearch 聚合

---

聚合提供了对数据进行分组、统计的能力，类似于SQL中GROUP by和SQL聚合函数。在Elasticsearch中，可以同时返回搜索结果及其聚合计算结果，这是非常强大和高效的。

下面的例子，对所有帐户按所在州分组，统计每组账户数量，然后返回前10个条目，按账户数量降序排列:

API

GET /bank/_search
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword"
      }
    }
  }
}

复制

CURL

curl -X GET "localhost:9200/bank/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword"
      }
    }
  }
}
'

复制

上述命令与以下SQL语句意义相同：

SELECT state, COUNT(*) FROM bank GROUP BY state ORDER BY COUNT(*) DESC LIMIT 10;

复制

响应：

{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1000,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "group_by_state" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 743,
      "buckets" : [
        {
          "key" : "TX",
          "doc_count" : 30
        },
        {
          "key" : "MD",
          "doc_count" : 28
        },
        {
          "key" : "ID",
          "doc_count" : 27
        },
        {
          "key" : "AL",
          "doc_count" : 25
        },
        {
          "key" : "ME",
          "doc_count" : 25
        },
        {
          "key" : "TN",
          "doc_count" : 25
        },
        {
          "key" : "WY",
          "doc_count" : 25
        },
        {
          "key" : "DC",
          "doc_count" : 24
        },
        {
          "key" : "MA",
          "doc_count" : 24
        },
        {
          "key" : "ND",
          "doc_count" : 24
        }
      ]
    }
  }
}

复制

可以看到ID(爱达荷州)有27个帐户，其次是TX(德克萨斯州)的27个帐户，然后是AL(阿拉巴马州)的25个帐户，等等。

注意，size=0表示不显示搜索结果，我们只想看到聚合结果。

基于前面例子的结果，下面例子同时按州计算平均帐户余额，然后返回前10个条目，按账户数量降序排列:

API

GET /bank/_search
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword"
      },
      "aggs": {
        "average_balance": {
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  }
}

复制

CURL

curl -X GET "localhost:9200/bank/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword"
      },
      "aggs": {
        "average_balance": {
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  }
}
'

复制

注意，average_balance聚合嵌入在group_by_state聚合中，这是聚合的常见模式，可以在聚合中任意嵌套聚合。

基于前面例子的结果，对结果按平均账户余额降序排序:

API

GET /bank/_search
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword",
        "order": {
          "average_balance": "desc"
        }
      },
      "aggs": {
        "average_balance": {
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  }
}

复制

CURL

curl -X GET "localhost:9200/bank/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "state.keyword",
        "order": {
          "average_balance": "desc"
        }
      },
      "aggs": {
        "average_balance": {
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  }
}
'

复制

下面例子按照年龄段(20-29岁，30-39岁，40-49岁)分组，然后按性别分组，统计每个年龄等级，每种性别的平均账户余额:

API

GET /bank/_search
{
  "size": 0,
  "aggs": {
    "group_by_age": {
      "range": {
        "field": "age",
        "ranges": [
          {
            "from": 20,
            "to": 30
          },
          {
            "from": 30,
            "to": 40
          },
          {
            "from": 40,
            "to": 50
          }
        ]
      },
      "aggs": {
        "group_by_gender": {
          "terms": {
            "field": "gender.keyword"
          },
          "aggs": {
            "average_balance": {
              "avg": {
                "field": "balance"
              }
            }
          }
        }
      }
    }
  }
}

复制

CURL

curl -X GET "localhost:9200/bank/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "group_by_age": {
      "range": {
        "field": "age",
        "ranges": [
          {
            "from": 20,
            "to": 30
          },
          {
            "from": 30,
            "to": 40
          },
          {
            "from": 40,
            "to": 50
          }
        ]
      },
      "aggs": {
        "group_by_gender": {
          "terms": {
            "field": "gender.keyword"
          },
          "aggs": {
            "average_balance": {
              "avg": {
                "field": "balance"
              }
            }
          }
        }
      }
    }
  }
}
'

复制

还有许多其他聚合功能，不再赘述，可参考聚合参考指南。

---

Doc navigation

← Elasticsearch 过滤