Metric Aggregation
单值分析
- min / max / avg / sum
- cardinality(类似 distinct count)
多值分析 | 输出多个分析结果
- stats / extended stats
- percentile / percentile rank
- top hits(排在前面的示例)
Metric Aggregation | 举几个栗子
创建索引 | employees
- 插入的数据就不贴在这了,太长;
DELETE /employees
PUT /employees/
{
"mappings" : {
"properties" : {
"age" : {
"type" : "integer"
},
"gender" : {
"type" : "keyword"
},
"job" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 50
}
}
},
"name" : {
"type" : "keyword"
},
"salary" : {
"type" : "integer"
}
}
}
}
查看最低工资
POST employees/_search
{
"size": 0,
"aggs": {
"min_salary": {
"min": {
"field":"salary"
}
}
}
}
查看最高工资
POST employees/_search
{
"size": 0,
"aggs": {
"max_salary": {
"max": {
"field":"salary"
}
}
}
}
一个聚合输出多个值
POST employees/_search
{
"size": 0,
"aggs": {
"stats_salary": {
"stats": {
"field":"salary"
}
}
}
}
一次查询包含多个聚合 | 同时查看最低、最高和平均工资
POST employees/_search
{
"size": 0,
"aggs": {
"max_salary": {
"max": {
"field": "salary"
}
},
"min_salary": {
"min": {
"field": "salary"
}
},
"avg_salary": {
"avg": {
"field": "salary"
}
}
}
}
Bucket
按照一定的规则,将文档分配到不同的桶中,从而达到分类的目的;ElasticSearch 提供的一些常见的 Bucket Aggregation:
- Terms
- 数字类型
- Range / Data Range
- Histogram / Date Histogram
Bucket 支持嵌套,也就是在桶里再做分桶;
Terms Aggregation
如果需要对 Text 类型的字段做 Terms Aggregation,需要字段打开 fielddata,才能进行;
Terms Aggregation | 举几个栗子
对 job 和 job.keyword 进行聚合
- 会统计出有多少种 job,就是多少个 Bucket,还有每个 Bucket 中有多少文档;
POST employees/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field":"job.keyword"
}
}
}
}
对 Text 类型的字段做 Terms 聚合
- 报错;
POST employees/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field":"job"
}
}
}
}
开启 Text 类型字段的 fielddata
- 开启之后就可以进行 Terms 聚合了;
- 但是 Text 类型的字段在索引进 ElasticSearch 时是做分词的,所以这里做的 Terms 聚合是分词后的聚合;
PUT employees/_mapping
{
"properties" : {
"job":{
"type": "text",
"fielddata": true
}
}
}
cardinality | 查看有多少种不同的 job.keyword
POST employees/_search
{
"size": 0,
"aggs": {
"cardinate": {
"cardinality": {
"field": "job.keyword"
}
}
}
}
对性别进行 Terms 聚合
- 查看有几种性别,每种性别下有多少员工;
POST employees/_search
{
"size": 0,
"aggs": {
"gender": {
"terms": {
"field":"gender"
}
}
}
}
指定 Bucket Size
- 只会分出 3 个 Bucket;
POST employees/_search
{
"size": 0,
"aggs": {
"ages_5": {
"terms": {
"field":"age",
"size":3
}
}
}
}
不同工种中,年纪最大的 3 个员工的具体信息
POST employees/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field":"job.keyword"
},
"aggs":{
"old_employee":{
"top_hits":{
"size":3,
"sort":[
{
"age":{
"order":"desc"
}
}
]
}
}
}
}
}
}
Terms Aggregation | 性能优化
- 每当有新的数据写入的时候,其 Terms 就会被加载到 Cache 当中,此时再做 Terms Aggregation 的时候,性能就会得到提升;
- 需要打开
eager_global_ordinals
的场景:- 当聚合查询非常频繁,并且对性能有较高要求;
- 同时索引有新的文档不断写入,通过打开预加载的 Cache,一旦有文档写入的时候,Terms Aggregation 就会被提前运算好,再做聚合分析的时候,速度就会得到大幅提升;
PUT index
{
"mappings":{
"properties":{
"foo":{
"type":"keyword",
"eager_global_ordinals":true
}
}
}
}
Range & Histogram Aggregation | 举几个栗子
按照工资的 Range 分桶
- 自定义工资分桶的范围区间;
POST employees/_search
{
"size": 0,
"aggs": {
"salary_range": {
"range": {
"field":"salary",
"ranges":[
{
"to":10000
},
{
"from":10000,
"to":20000
},
{
"key":">20000",
"from":20000
}
]
}
}
}
}
按照工资的间隔分桶
- 工资在 1 ~ 100000 之间,以每 5000 为一个间隔分桶;
POST employees/_search
{
"size": 0,
"aggs": {
"salary_histrogram": {
"histogram": {
"field":"salary",
"interval":5000,
"extended_bounds":{
"min":0,
"max":100000
}
}
}
}
}
Bucket + Metric Aggregation | 嵌套聚合
Bucket 聚合分析允许通过添加子聚合分析来进一步分析,自聚合分析可以是:
- Bucket
- Metric
Bucket + Metric Aggregation | 嵌套聚合 | 举几个栗子
按照工资类别分桶,并统计工资信息
POST employees/_search
{
"size": 0,
"aggs": {
"Job_salary_stats": {
"terms": {
"field": "job.keyword"
},
"aggs": {
"salary": {
"stats": {
"field": "salary"
}
}
}
}
}
}
根据工作类型分桶 | 然后按照性别分桶 | 计算工资的统计信息
POST employees/_search
{
"size": 0,
"aggs": {
"Job_gender_stats": {
"terms": {
"field": "job.keyword"
},
"aggs": {
"gender_stats": {
"terms": {
"field": "gender"
},
"aggs": {
"salary_stats": {
"stats": {
"field": "salary"
}
}
}
}
}
}
}
}