命令
"aggregations" : { // 表示聚合操作,可以使用aggs替代
"" : { // 聚合名,可以是任意的字符串。用做响应的key,便于快速取得正确的响应数据。
"" : { // 聚合类别,就是各种类型的聚合,如min等
// 聚合体,不同的聚合有不同的body }
[,"aggregations" : { []+ } ]? // 嵌套的子聚合,可以有0或多个 }
[,"" : { ... } ]* // 另外的聚合,可以有0或多个 也可以嵌套query和filter
}
示例:
按时间段,更加某个字段进行分组统计
GET /test_index/_search
{
"size": 0,
"aggs": {
"时间": {
"terms": {
"field": "ABILITY_CODE.keyword"
},
"aggs": {
"统计": {
"stats": {
"field": "ACOST_VALUE"
}
}
}
}
},
"query": {
"bool": {
"filter": [
{
"range": {
"A_IN_TIME": {
"gte": 1534425660084,
"lte": 1534425660224
}
}
}
]
}
}
}
输出结果为
{
"took" : 1,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 100,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"时间" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "TJ_UNHQ_QueryAcctDep",
"doc_count" : 50,
"统计" : {
"count" : 50,
"min" : 10.0,
"max" : 98.0,
"avg" : 49.3,
"sum" : 2465.0
}
},
{
"key" : "TJ_UNHQ_queryUserInfoBySnNew",
"doc_count" : 50,
"统计" : {
"count" : 50,
"min" : 10.0,
"max" : 109.0,
"avg" : 59.42,
"sum" : 2971.0
}
}
]
}
}
}