elasticsearch聚合

 

分组聚合

POST  razor_v1/event/_search

{
  "size": 0,
  "aggs": {
    "group_by_state": {
      "terms": {
        "field": "acc"
      }
    }
  }
}

 

{
  "aggs": {
    "acc_max": {
      "max": {
        "field": "acc"
      }
    }
  }
}

 

{
  "aggs": {
    "acc_sum": {
      "sum": {
        "field": "acc"
      }
    }
  }
}

 

 

基数聚合 cardinality aggregation

POST  razor_v1/event/_search?search_type=count

{
  "aggs": {
    "distinct_userids": {
      "cardinality": {
        "field": "useridentifier"
      }
    }
  }
}

 
多值度量聚合 multi-value metrics aggregation

POST  razor_v1/event/_search?search_type=count

{
  "aggs": {
    "acc_stats": {
      "extended_stats": {
        "field": "acc"
      }
    }
  }
}

结果

{
"took": 3,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 10750,
"max_score": 0,
"hits": [ ]
},
"aggregations": {
"acc_stats": {
"count": 10750,
"min": 1,
"max": 5,
"avg": 3.0275348837209304,
"sum": 32546,
"sum_of_squares": 120210,
"variance": 2.0163581092482414,
"std_deviation": 1.4199852496586862,
"std_deviation_bounds": {
"upper": 5.867505383038303,
"lower": 0.18756438440355794
}
}
}
}

  

 多指标应用  桶

{
  "aggs": {
    "userids": {
      "terms": {
        "field": "useridentifier"
      },
      "aggs": {
        "avg_acc": {
          "avg": {
            "field": "acc"
          }
        }
      }
    }
  }
}

结果 写道

{
"took": 9,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 10750,
"max_score": 0,
"hits": [ ]
},
"aggregations": {
"userids": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 6033,
"buckets": [
{
"key": "colord",
"doc_count": 487,
"avg_acc": {
"value": 3.051334702258727
}
}
,
{
"key": "usbmux",
"doc_count": 462,
"avg_acc": {
"value": 3.0064935064935066
}
}
]
}
}
}

  

桶中的桶

 

{
  "aggs": {
    "userids": {
      "terms": {
        "field": "useridentifier"
      },
      "aggs": {
        "avg_acc": {
          "avg": {
            "field": "acc"
          }
        },
        "make": {
          "terms": {
            "field": "version"
          }
        }
      }
    }
  }
}

 

结果 写道

{
"took": 46,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 10750,
"max_score": 0,
"hits": [ ]
},
"aggregations": {
"userids": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 6033,
"buckets": [
{
"key": "redis",
"doc_count": 513,
"avg_acc": {
"value": 2.982456140350877
},
"make": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "3.0",
"doc_count": 115
}
,
{
"key": "2.0",
"doc_count": 89
}
]
}
}
,
{
"key": "colord",
"doc_count": 487,
"avg_acc": {
"value": 3.051334702258727
},
"make": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "3.0",
"doc_count": 136
}
,
{
"key": "2.4",
"doc_count": 74
}
]
}
}
,
{
"key": "uuidd",
"doc_count": 479,
"avg_acc": {
"value": 2.9958246346555324
},
"make": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "3.0",
"doc_count": 116
}
,
{
"key": "2.0",
"doc_count": 71
}
]
}
}
,
{
"key": "dawn",
"doc_count": 477,
"avg_acc": {
"value": 2.989517819706499
},
"make": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "3.0",
"doc_count": 122
}
,
{
"key": "2.0",
"doc_count": 93
}
]
}
}
,
{
"key": "dbus",
"doc_count": 477,
"avg_acc": {
"value": 3.0943396226415096
},
"make": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "3.0",
"doc_count": 128
}
,
{
"key": "2.0",
"doc_count": 76
}
]
}
}
,
{
"key": "usbmux",
"doc_count": 462,
"avg_acc": {
"value": 3.0064935064935066
},
"make": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "3.0",
"doc_count": 138
}
,
{
"key": "2.0",
"doc_count": 74
}
]
}
}
,
{
"key": "http",
"doc_count": 460,
"avg_acc": {
"value": 3.0282608695652176
},
"make": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "3.0",
"doc_count": 135
}
,
{
"key": "2.0",
"doc_count": 78
}
]
}
}
,
{
"key": "ntp",
"doc_count": 458,
"avg_acc": {
"value": 2.997816593886463
},
"make": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "3.0",
"doc_count": 115
}
,
{
"key": "2.4",
"doc_count": 71
}
]
}
}
,
{
"key": "daemon",
"doc_count": 456,
"avg_acc": {
"value": 2.9846491228070176
},
"make": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "3.0",
"doc_count": 132
}
,
{
"key": "2.4",
"doc_count": 78
}
]
}
}
,
{
"key": "nobody",
"doc_count": 448,
"avg_acc": {
"value": 3.127232142857143
},
"make": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "3.0",
"doc_count": 124
}
,
{
"key": "1.2",
"doc_count": 66
}
]
}
}
]
}
}
}

 

 

 参考：

Aggregation Test-Drive；

聚合的测试数据(Aggregation Test-Drive 译文)；

Aggregations;