elasticsearch 语句 group by多个字段

先group by td_deviceId 再 group by uid

GET index*/_search
{
  "_source": ["td_deviceId"], 
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "createTime": {
              "gte": "2023-04-28T08:00:00.000+0800",
              "lte": "2023-05-08T23:59:59.068+0800"
            }
          }
        }
      ],
      "must": [
        {"match": {
          "platform": "wxmp"
        }}
      ]
    }
  },
  "aggs": {
    "by td_deviceId": {
      "terms": {
        "field": "td_deviceId",
        "size": 7000
        },
       "aggs": {
        "by uid": {
          "cardinality": {
            "field": "uid"
          }
        }
      }
    }
  }
}

同时group by 
GET index*/_search
{
  "_source": ["td_deviceId"], 
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "createTime": {
              "gte": "2023-04-28T08:00:00.000+0800",
              "lte": "2023-05-08T23:59:59.068+0800"
            }
          }
        }
      ],
      "must": [
        {"match": {
          "platform": "wxmp"
        }}
      ]
    }
  },
  "aggs": {
    "by td_deviceId": {
      "composite": {
        "sources": [
          {
            "bc td_deviceId": {
              "terms": {
                "field": "td_deviceId"
              }
            }
          },
          {
            "by uid":{
              "terms": {
                "field": "uid"
              }
            }
          }
        ]
      }
    }
  }
}

composite用于es 6以上,并且是实验参数

在 Elasticsearch 中，Composite Aggregation 用于分组聚合，并且可以帮助提高聚合操作的性能。它可以对多个字段进行分组，并通过指定一个或多个桶排序规则来对结果进行排序。

具体而言，Composite Aggregation 可以将一个或多个 field 作为分组依据，然后按照指定的顺序对每个分组中的文档进行排序。此外，它还可以对任意数量的桶进行分层，从而创建一个可以在多个级别上进行细分和总结的视图。例如，您可以使用 Composite Aggregation 来执行以下任务：

• 对数据进行分页，返回特定数量的结果
• 将一个字段分组，并按另一个字段进行排序
• 按日期范围分组，并按数字字段排序

除此之外，Composite Aggregation 还有一些其他的配置选项，比如 size、after_key 等，可以帮助您更好地控制查询结果。

select count(group by uid), id,id_count from index where key = val and createTime between start and end group by id,uid having Count >1

GET /index/_search
{
  "_source": ["id"], 
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "createTime": {
              "gte": "start",
              "lte": "end"
            }
          }
        }
      ],
      "must": [
        {"match": {
          "key": "val"
        }}
      ]
    }
  },
  "aggs": {
     "id_count":{
     //分组总数
      "cardinality": {
            "field": "id"
          }
    },
    //多个字段分组
    "group by id":{
      "terms": {
        "field": "id",
        "order": {"uid_count":"desc"},
        "size":6000
      },
      "aggs": {
        "uid_count": {
          "cardinality": {
            "field": "uid"
          }
        },
        //uid count 并且 大于 1
        "uid_count_filter":{
          "bucket_selector": {
            "buckets_path": {"uidCount":"uid_count"},
            "script": "params.uidCount>1"
          }
        }
      }
    },
    
    //所有分组相加后的总数
    "stats_deviceId":{
      "stats_bucket":{
        "buckets_path":"group by id._count"
      }
    }
  }
}