当前位置：首页 > news >正文

ElasticSearch 聚合统计

news 2025/9/15 17:28:25

在这里插入图片描述

聚合统计

度量聚合：求字段的平均值，最小值，最大值，总和等
桶聚合：将文档分成不同的桶，桶的划分可以根据字段的值，范围，日期间隔
管道聚合：在桶聚合的结果上执行进一步计算

进行聚合的语法如下

{"aggs": {"<agg_name>": {"<agg_type>": {"field": "<field_name>"}}}
}

聚合也可以进行嵌套

{"aggs": {"<agg_name>": {"<agg_type>": {"field": "<field_name>"},"aggs": {"<agg_child_name>": {"<agg_type>": {"field": "<field_name>"}}}}}
}

度量聚合（Metrics aggregations）

平均值聚合

聚集被命名为 avg_age

POST user/_search
{"query": {"match_all": {}},"aggs": {"avg_age": {"avg": {"field": "age"}}}
}

最小值 / 最大值聚合

POST user/_search
{"query": {"match_all": {}},"aggs": {"max_age": {"max": {"field": "age"}}}
}

POST user/_search
{"query": {"match_all": {}},"aggs": {"min_age": {"min": {"field": "age"}}}
}

求和聚合

POST user/_search
{"query": {"match_all": {}},"aggs": {"sum_age": {"sum": {"field": "age"}}}
}

桶聚合（Bucket aggregations）

词条聚合（Terms aggregation）

按照某个字段的值进行聚合

POST user/_search
{"query": {"match_all": {}},"aggs": {"group_by_age": {"terms": {"field": "age"}}}
}

范围聚合（Range aggregation）

按照某个字段的范围进行聚合，from提供区间下界（包括），to提供区间上界（不包括）

POST user/_search
{"query": {"match_all": {}},"aggs": {"age_ranges":{"range": {"field": "age","ranges": [{ "to": 10 },{ "from": 10, "to": 20 },{ "from": 20 }]}}}
}

管道聚合（Pipeline aggregations）

平均桶聚合（Average bucket aggregation）

POST user/_search
{"query": {"match_all": {}},"aggs": {"age_ranges": {"range": {"field": "age","ranges": [{ "to": 10 }, { "from": 10, "to": 20 }, { "from": 20 }]},"aggs": {"age_avg": {"avg": {"field": "age"}}}},"range_avg": {"avg_bucket": {"buckets_path": "age_ranges>age_avg"}}}
}

对年龄分组，并求分组后的平均值，然后对分组的平均值再求平均值

求和桶聚集（Sum bucket aggregation）

POST user/_search
{"query": {"match_all": {}},"aggs": {"age_ranges": {"range": {"field": "age","ranges": [{ "to": 10 }, { "from": 10, "to": 20 }, { "from": 20 }]},"aggs": {"age_sum": { "sum": {"field": "age"} }}},"range_sum": {"sum_bucket": { "buckets_path": "age_ranges>age_sum" }}}
}