ES多字段聚合取聚合结果

private Map<String, Long> errorCount(ParamModel paramModel, RestHighLevelClient restHighLevelClient) {
   SearchResponse response = null;
   Map<String, Long> countResult = new HashMap<>();
   try {
      SearchRequest searchRequest = new SearchRequest(INDEX_NAME);
      searchRequest.types(SEARCH_TYPE);
      SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
      //获取开始时间
      long startTime = DateTimeUtil.getTime(paramModel.getDateTime(), paramModel.getTimeFrame());
      //获取结束时间
      long endTime = paramModel.getDateTime();
      //查询条件
      QueryBuilder query = QueryBuilders.boolQuery().must(QueryBuilders.rangeQuery("timestamp").from(new Date(startTime)).to(new Date(endTime))).must(QueryBuilders.matchQuery("level", "ERROR"));
      //统计条件
      TermsAggregationBuilder serviceLineAgg = AggregationBuilders.terms("serviceline_count").field("serviceline");
      TermsAggregationBuilder appNameAgg = AggregationBuilders.terms("appName_count").field("appName");

      searchSourceBuilder.query(query).size(0);
      searchSourceBuilder.aggregation(serviceLineAgg.subAggregation(appNameAgg)).size(0);
      searchRequest.source(searchSourceBuilder);
      response = restHighLevelClient.search(searchRequest);
      //组装数据
      analyticData(response, countResult);

      logger.info(response.toString());
   } catch (IOException e) {
      logger.error(e.getMessage(), e);
   }

//代码聚合的字段为serviceline、appName
private void analyticData(SearchResponse response, Map<String, Long> countResult) {
   Map<String, Aggregation> serviceLineMap = response.getAggregations().asMap();
   ParsedStringTerms serviceLineTerms = (ParsedStringTerms) serviceLineMap.get("serviceline_count");
   List serviceLists = serviceLineTerms.getBuckets();
   for (Object serviceList : serviceLists) {
      ParsedStringTerms.ParsedBucket serviceListObj = (ParsedStringTerms.ParsedBucket) serviceList;
      String serviceLine = serviceListObj.getKeyAsString();
      Map<String, Aggregation> appNameMap = serviceListObj.getAggregations().asMap();
      ParsedStringTerms appNameTerms = (ParsedStringTerms) appNameMap.get("appName_count");
      List appNameLists = appNameTerms.getBuckets();
      for (Object appNameList : appNameLists) {
         ParsedStringTerms.ParsedBucket appNameObj = (ParsedStringTerms.ParsedBucket) appNameList;
         String appName = appNameObj.getKeyAsString();
         Long count = appNameObj.getDocCount();
         countResult.put(serviceLine + "&" + appName, count);
      }
   }
}