一、指标聚合
(1) Max Aggregation 用于最大值统计;
(2) Min Aggregation 用于最小值统计;
(3) Avg Aggregation 用于计算平均值;
(4) Sum Aggregation 用于计算综合;
(5) Cardinality Aggregation 用于基数统计。其作用类似于SQL中去重复之后计算集合的长度;
(6) Stats Aggregation 用于基本统计,一次返回 count、max、min、avg 和 sum;
(7) Extended Stats Aggregation 用于高级统计,在基本统计结果上多了平方和、方差、标准差 和 平均值加/减两个标准差;
(8) Percentiles Aggregation 用于百分位统计;
百分位数是一个统计数术语,如果将一组数据从大到小排序,并计算相应的累积百分位,某一百分位所对应数据的值就称为这一百分位的百分数。
(9) Value Count Aggregation 可按字段统计文档数量。
{
"size": 0,
"aggs": {
"max_price": {
"max": {"field": "price"}
},
"min_price": {
"min": {"field": "price"}
},
"avg_price": {
"avg": {"field": "price"}
},
"sum_price": {
"sum": {"field": "price"}
},
"all_language": {
"cardinality": {"field": "language"}
},
"grades_stats": {
"stats": {"field": "price"}
},
"extended_grades_stats": {
"extended_stats": {"field": "price"}
},
"book_price": {
"percentiles": {"field": "price"}
},
"doc_count": {
"value_count": {"field": "author"}
}
}
}
结果:
{
"took": 116,
"timed_out": false,
"_shards": {
"total": 3,
"successful": 3,
"failed": 0
},
"hits": {
"total": 5,
"max_score": 0,
"hits": []
},
"aggregations": {
"book_price": {
"values": {
"1.0": 46.82,
"5.0": 48.1,
"25.0": 54.5,
"50.0": 66.4,
"75.0": 70.2,
"95.0": 79.16,
"99.0": 80.95200000000001
}
},
"doc_count": {
"value": 5
},
"max_price": {
"value": 81.4
},
"min_price": {
"value": 46.5
},
"grades_stats": {
"count": 5,
"min": 46.5,
"max": 81.4,
"avg": 63.8,
"sum": 319
},
"all_language": {
"value": 3
},
"avg_price": {
"value": 63.8
},
"sum_price": {
"value": 319
},
"extended_grades_stats": {
"count": 5,
"min": 46.5,
"max": 81.4,
"avg": 63.8,
"sum": 319,
"sum_of_squares": 21095.46,
"variance": 148.65199999999967,
"std_deviation": 12.19229264740638,
"std_deviation_bounds": {
"upper": 88.18458529481276,
"lower": 39.41541470518724
}
}
}
}
二、桶聚合
桶聚合类似于Sql查询中的 group by;
1、terms aggregation 用于分组聚合。
根据 language 字段进行分组统计书的数量
{
"size": 0,
"aggs": {
"per_count": {
"terms": {"field" : "language"}
}
}
}
结果:
{
"took": 34,
"timed_out": false,
"_shards": {
"total": 3,
"successful": 3,
"failed": 0
},
"hits": {
"total": 5,
"max_score": 0,
"hits": []
},
"aggregations": {
"per_count": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "java",
"doc_count": 2
},
{
"key": "python",
"doc_count": 2
},
{
"key": "javascript",
"doc_count": 1
}
]
}
}
}
在 terms 分桶基础上还可以对每个桶进行指标聚合:
{
"size": 0,
"aggs": {
"per_count": {
"terms": {"field" : "language"},
"aggs": {
"avg_price": {
"avg": {"field":"price"}
}
}
}
}
}
2、filter aggregation 过滤器聚合,可以把符合过滤条件的文档放在一个桶中。
计算 title 字段中含有关键词 java的文档的平均价格:
{
"size": 0,
"aggs": {
"java_avg_price": {
"filter": {
"term": { "title" : "java"}
},
"aggs": {
"avg_price": {
"avg": {"field":"price"}
}
}
}
}
}
3、filters aggregation 多过滤器聚合,可以把符合多个过滤条件的文档分别放到不同的桶中。
{
"size": 0,
"aggs": {
"pre_avg_price": {
"filters": {
"filters": [
{ "match" : { "title" : "java"}},
{ "match" : { "title" : "python"}}
]
},
"aggs": {
"avg_price": {
"avg": {"field":"price"}
}
}
}
}
}
结果:
{
"aggregations": {
"pre_avg_price": {
"buckets": [
{
"doc_count": 2,
"avg_price": {
"value": 58.35
}
},
{
"doc_count": 2,
"avg_price": {
"value": 67.95
}
}
]
}
}
}
4、range aggregation 范围聚合,用于反映数据的分布情况。
range aggregation 不仅仅可以对数值型字段进行范围统计,也可以对日期类型进行统计。
对图书按照价格区间在 [0,50),[50,80),[80,*) 进行范围聚合统计:
{
"size": 0,
"aggs": {
"price_ranges": {
"range": {
"field": "price",
"ranges": [
{"to" : 50},
{"from":50, "to":80},
{"from":80}
]
}
}
}
}
结果:
{
"aggregations": {
"price_ranges": {
"buckets": [
{
"key": "*-50.0",
"to": 50,
"doc_count": 1
},
{
"key": "50.0-80.0",
"from": 50,
"to": 80,
"doc_count": 3
},
{
"key": "80.0-*",
"from": 80,
"doc_count": 1
}
]
}
}
}
5、date range aggregation 专门用于对日期类型的范围聚合。相比于 range aggregation范围聚合, date range aggregation范围聚合日期的起止值可以使用数学表达式。
第一个范围是两年以前,第二个范围是两年前以后:
{
"size": 0,
"aggs": {
"ranges": {
"date_range": {
"field": "publish_time",
"format": "yyyy-MM-dd",
"ranges": [
{"to" : "now-24M/M"},
{"from": "now-24M/M"}
]
}
}
}
}
结果:
{
"aggregations": {
"ranges": {
"buckets": [
{
"key": "*-2016-08-01",
"to": 1470009600000,
"to_as_string": "2016-08-01",
"doc_count": 5
},
{
"key": "2016-08-01-*",
"from": 1470009600000,
"from_as_string": "2016-08-01",
"doc_count": 0
}
]
}
}
}
6、date histogram aggregation 是时间直方图聚合,常用于按照日期对文档进行统计并绘制条形图。
{
"size": 0,
"aggs": {
"ranges": {
"date_histogram": {
"field": "publish_time",
"interval": "year"
}
}
}
}
field:表示统计的字段
interval:表示横坐标的时间单位
7、missing aggregation 是空置聚合,可以把文档集中所有却是字段(包括取值为null)的文档分到一个桶中。
8、children aggregation 是一种特殊的单桶聚合,可以根据父子文档关系进行分桶。
9、geo distance aggregation 用于对地理点做范围统计。
10、ip range aggregation 用于对IP类型数据范围聚合分桶。