精华内容
下载资源
问答
  • 聚合分析的值来源","27:\"12\"|31:2"],[20,"\n","24:\"d8C9\"|32:3|linespacing:\"150\""],[20,"聚合计算的值可以取","31:2"],[20,"字段的值","31:2|8:1"],[20,",也可是","31:2"],[20,"脚本计算的结果","31:2|8:1...

    \" : { "],[20,"\n","24:\"QKVd\"|36:177"],[20," \"\" : { "],[20,"\n","24:\"qq70\"|36:177"],[20,""],[20,"\n","24:\"EZTv\"|36:177"],[20," }"],[20,"\n","24:\"Ocmo\"|36:177"],[20," [,\"meta\" : { [] } ]? "],[20,"\n","24:\"pNIr\"|36:177"],[20," [,\"aggregations\" : { []+ } ]? "],[20,"\n","24:\"UFZF\"|36:177"],[20," }"],[20,"\n","24:\"yMjg\"|36:177"],[20," [,\"\" : { ... } ]*"],[20,"\n","24:\"cQiu\"|36:177"],[20,"}"],[20,"\n","24:\"cHkq\"|36:177"],[20,"\n","24:\"hvbC\""],[20," 说明:","0:\"%23ff0000\"|31:2|8:1"],[20,"\n","24:\"UACt\""],[20,"aggregations 也可简写为 aggs","0:\"%23ff0000\"|31:2|8:1"],[20,"\n","24:\"3QtL\""],[20," 3. 聚合分析的值来源","27:\"12\"|31:2"],[20,"\n","24:\"d8C9\"|32:3|linespacing:\"150\""],[20,"聚合计算的值可以取","31:2"],[20,"字段的值","31:2|8:1"],[20,",也可是","31:2"],[20,"脚本计算的结果","31:2|8:1"],[20,"。","31:2"],[20,"\n","24:\"HZzc\""],[20,"二、指标聚合","27:\"16\"|31:2"],[20,"\n","24:\"W2mW\"|32:2|linespacing:\"150\""],[20,"1. max min sum avg","27:\"12\"|31:2"],[20,"\n","24:\"qK94\"|32:3|linespacing:\"150\""],[20,"示例1:查询所有客户中余额的最大值","31:2"],[20,"\n","24:\"g3SD\""],[20,"\n","24:\"bryQ\""],[20,"POST /bank/_search?"],[20,"\n","24:\"u1zI\"|36:177"],[20,"{"],[20,"\n","24:\"SxRe\"|36:177"],[20," \"size\": 0, "],[20,"\n","24:\"yHUS\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"ByGz\"|36:177"],[20," \"masssbalance\": {"],[20,"\n","24:\"nE4z\"|36:177"],[20," \"max\": {"],[20,"\n","24:\"9RMF\"|36:177"],[20," \"field\": \"balance\""],[20,"\n","24:\"Ikd2\"|36:177"],[20," }"],[20,"\n","24:\"VShd\"|36:177"],[20," }"],[20,"\n","24:\"1RUo\"|36:177"],[20," }"],[20,"\n","24:\"hqWh\"|36:177"],[20,"}"],[20,"\n","24:\"nY9g\"|36:177"],[20," 结果1:","31:2"],[20,"\n","24:\"S4sn\""],[20,"\n","24:\"pjIf\""],[20,"{"],[20,"\n","24:\"hGMJ\"|36:177"],[20," \"took\": 2080,"],[20,"\n","24:\"2iqk\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"3g2G\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"1dap\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"kcz5\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"S14v\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"g3D2\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"knn4\"|36:177"],[20," },"],[20,"\n","24:\"124i\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"thTk\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"C3xW\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"r8Lc\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"7Izi\"|36:177"],[20," },"],[20,"\n","24:\"UFNi\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"xrlX\"|36:177"],[20," \"masssbalance\": {"],[20,"\n","24:\"4PBX\"|36:177"],[20," \"value\": 49989"],[20,"\n","24:\"m9Uj\"|36:177"],[20," }"],[20,"\n","24:\"Qal4\"|36:177"],[20," }"],[20,"\n","24:\"ttim\"|36:177"],[20,"}"],[20,"\n","24:\"3vTH\"|36:177"],[20,"示例2:查询年龄为24岁的客户中的余额最大值","31:2"],[20,"\n","24:\"X9HC\""],[20,"\n","24:\"qqbp\""],[20,"POST /bank/_search?"],[20,"\n","24:\"0yhK\"|36:177"],[20,"{"],[20,"\n","24:\"1Nnb\"|36:177"],[20," \"size\": 2, "],[20,"\n","24:\"L7z1\"|36:177"],[20," \"query\": {"],[20,"\n","24:\"OveL\"|36:177"],[20," \"match\": {"],[20,"\n","24:\"X0CX\"|36:177"],[20," \"age\": 24"],[20,"\n","24:\"o9Yh\"|36:177"],[20," }"],[20,"\n","24:\"z6wY\"|36:177"],[20," },"],[20,"\n","24:\"TysR\"|36:177"],[20," \"sort\": ["],[20,"\n","24:\"vLQs\"|36:177"],[20," {"],[20,"\n","24:\"zUl9\"|36:177"],[20," \"balance\": {"],[20,"\n","24:\"jzt6\"|36:177"],[20," \"order\": \"desc\""],[20,"\n","24:\"GzrK\"|36:177"],[20," }"],[20,"\n","24:\"sKbn\"|36:177"],[20," }"],[20,"\n","24:\"hobF\"|36:177"],[20," ],"],[20,"\n","24:\"PZsN\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"Kdar\"|36:177"],[20," \"max_balance\": {"],[20,"\n","24:\"i4oC\"|36:177"],[20," \"max\": {"],[20,"\n","24:\"Xj8s\"|36:177"],[20," \"field\": \"balance\""],[20,"\n","24:\"EaZA\"|36:177"],[20," }"],[20,"\n","24:\"nPjr\"|36:177"],[20," }"],[20,"\n","24:\"hGSq\"|36:177"],[20," }"],[20,"\n","24:\"tq7Y\"|36:177"],[20,"}"],[20,"\n","24:\"kFt0\"|36:177"],[20,"\n","24:\"xg75\""],[20," 结果2:","31:2"],[20,"\n","24:\"V4JY\""],[20,"\n","24:\"zFSI\""],[20,"{"],[20,"\n","24:\"8nG4\"|36:177"],[20," \"took\": 5,"],[20,"\n","24:\"Tci9\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"2Cn8\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"K6UP\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"w3IF\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"fqvP\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"8kXv\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"zWbo\"|36:177"],[20," },"],[20,"\n","24:\"HaRU\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"rW8o\"|36:177"],[20," \"total\": 42,"],[20,"\n","24:\"qhaq\"|36:177"],[20," \"max_score\": null,"],[20,"\n","24:\"l5MJ\"|36:177"],[20," \"hits\": ["],[20,"\n","24:\"OPDl\"|36:177"],[20," {"],[20,"\n","24:\"cRYF\"|36:177"],[20," \"_index\": \"bank\","],[20,"\n","24:\"7SY4\"|36:177"],[20," \"_type\": \"_doc\","],[20,"\n","24:\"fCzs\"|36:177"],[20," \"_id\": \"697\","],[20,"\n","24:\"G5IW\"|36:177"],[20," \"_score\": null,"],[20,"\n","24:\"T3rI\"|36:177"],[20," \"_source\": {"],[20,"\n","24:\"XcfJ\"|36:177"],[20," \"account_number\": 697,"],[20,"\n","24:\"1WbQ\"|36:177"],[20," \"balance\": 48745,"],[20,"\n","24:\"bJP3\"|36:177"],[20," \"firstname\": \"Mallory\","],[20,"\n","24:\"MnYe\"|36:177"],[20," \"lastname\": \"Emerson\","],[20,"\n","24:\"schf\"|36:177"],[20," \"age\": 24,"],[20,"\n","24:\"nXJ4\"|36:177"],[20," \"gender\": \"F\","],[20,"\n","24:\"9A0k\"|36:177"],[20," \"address\": \"318 Dunne Court\","],[20,"\n","24:\"U6NC\"|36:177"],[20," \"employer\": \"Exoplode\","],[20,"\n","24:\"Lszf\"|36:177"],[20," \"email\": \"malloryemerson@exoplode.com\","],[20,"\n","24:\"xf82\"|36:177"],[20," \"city\": \"Montura\","],[20,"\n","24:\"ppCV\"|36:177"],[20," \"state\": \"LA\""],[20,"\n","24:\"fvSp\"|36:177"],[20," },"],[20,"\n","24:\"tAAk\"|36:177"],[20," \"sort\": ["],[20,"\n","24:\"IX1a\"|36:177"],[20," 48745"],[20,"\n","24:\"8DSh\"|36:177"],[20," ]"],[20,"\n","24:\"YkbH\"|36:177"],[20," },"],[20,"\n","24:\"mMJc\"|36:177"],[20," {"],[20,"\n","24:\"DYEa\"|36:177"],[20," \"_index\": \"bank\","],[20,"\n","24:\"isvh\"|36:177"],[20," \"_type\": \"_doc\","],[20,"\n","24:\"hBsb\"|36:177"],[20," \"_id\": \"917\","],[20,"\n","24:\"dcRz\"|36:177"],[20," \"_score\": null,"],[20,"\n","24:\"ezFw\"|36:177"],[20," \"_source\": {"],[20,"\n","24:\"Nwgg\"|36:177"],[20," \"account_number\": 917,"],[20,"\n","24:\"8sqM\"|36:177"],[20," \"balance\": 47782,"],[20,"\n","24:\"pXb5\"|36:177"],[20," \"firstname\": \"Parks\","],[20,"\n","24:\"AOXU\"|36:177"],[20," \"lastname\": \"Hurst\","],[20,"\n","24:\"30Ib\"|36:177"],[20," \"age\": 24,"],[20,"\n","24:\"fYCK\"|36:177"],[20," \"gender\": \"M\","],[20,"\n","24:\"DnZk\"|36:177"],[20," \"address\": \"933 Cozine Avenue\","],[20,"\n","24:\"qTZn\"|36:177"],[20," \"employer\": \"Pyramis\","],[20,"\n","24:\"8Uzy\"|36:177"],[20," \"email\": \"parkshurst@pyramis.com\","],[20,"\n","24:\"7diB\"|36:177"],[20," \"city\": \"Lindcove\","],[20,"\n","24:\"FYO8\"|36:177"],[20," \"state\": \"GA\""],[20,"\n","24:\"4edL\"|36:177"],[20," },"],[20,"\n","24:\"gRhs\"|36:177"],[20," \"sort\": ["],[20,"\n","24:\"nsNR\"|36:177"],[20," 47782"],[20,"\n","24:\"CRkP\"|36:177"],[20," ]"],[20,"\n","24:\"3lEA\"|36:177"],[20," }"],[20,"\n","24:\"Qbfw\"|36:177"],[20," ]"],[20,"\n","24:\"qUZT\"|36:177"],[20," },"],[20,"\n","24:\"HdKL\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"ayql\"|36:177"],[20," \"max_balance\": {"],[20,"\n","24:\"svoW\"|36:177"],[20," \"value\": 48745"],[20,"\n","24:\"FzLL\"|36:177"],[20," }"],[20,"\n","24:\"Rgeb\"|36:177"],[20," }"],[20,"\n","24:\"ulD3\"|36:177"],[20,"}"],[20,"\n","24:\"alH5\"|36:177"],[20,"\n","24:\"nKlA\""],[20," 示例3:值来源于脚本,查询所有客户的平均年龄是多少,并对平均年龄加10","31:2"],[20,"\n","24:\"4syh\""],[20,"\n","24:\"eAof\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"j7Zo\"|36:177"],[20,"{"],[20,"\n","24:\"cWkO\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"i1Jg\"|36:177"],[20," \"avg_age\": {"],[20,"\n","24:\"iEjs\"|36:177"],[20," \"avg\": {"],[20,"\n","24:\"ZpF5\"|36:177"],[20," \"script\": {"],[20,"\n","24:\"VX27\"|36:177"],[20," \"source\": \"doc.age.value\""],[20,"\n","24:\"S8sf\"|36:177"],[20," }"],[20,"\n","24:\"DhNc\"|36:177"],[20," }"],[20,"\n","24:\"5wf2\"|36:177"],[20," },"],[20,"\n","24:\"mslj\"|36:177"],[20," \"avg_age10\": {"],[20,"\n","24:\"pVBM\"|36:177"],[20," \"avg\": {"],[20,"\n","24:\"8Muu\"|36:177"],[20," \"script\": {"],[20,"\n","24:\"e0sx\"|36:177"],[20," \"source\": \"doc.age.value + 10\""],[20,"\n","24:\"eXJo\"|36:177"],[20," }"],[20,"\n","24:\"wgr7\"|36:177"],[20," }"],[20,"\n","24:\"VGyS\"|36:177"],[20," }"],[20,"\n","24:\"Wx3Z\"|36:177"],[20," }"],[20,"\n","24:\"a3X4\"|36:177"],[20,"}"],[20,"\n","24:\"abAz\"|36:177"],[20,"\n","24:\"S02c\""],[20," 结果3:","31:2"],[20,"\n","24:\"WBh5\""],[20,"\n","24:\"7iMh\""],[20,"{"],[20,"\n","24:\"TSR2\"|36:177"],[20," \"took\": 86,"],[20,"\n","24:\"0NFx\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"RJNp\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"nwz4\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"LNzs\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"hRk1\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"w7iE\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"GEUY\"|36:177"],[20," },"],[20,"\n","24:\"dl7l\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"kdok\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"k6iB\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"lMoc\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"EwRJ\"|36:177"],[20," },"],[20,"\n","24:\"C9ZE\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"NJ9x\"|36:177"],[20," \"avg_age\": {"],[20,"\n","24:\"yHoX\"|36:177"],[20," \"value\": 30.171"],[20,"\n","24:\"X3y4\"|36:177"],[20," },"],[20,"\n","24:\"j1gU\"|36:177"],[20," \"avg_age10\": {"],[20,"\n","24:\"aKmh\"|36:177"],[20," \"value\": 40.171"],[20,"\n","24:\"QxwM\"|36:177"],[20," }"],[20,"\n","24:\"tlKh\"|36:177"],[20," }"],[20,"\n","24:\"3H3E\"|36:177"],[20,"}"],[20,"\n","24:\"y96W\"|36:177"],[20,"\n","24:\"x7Xo\""],[20," 示例4:指定field,在脚本中用_value 取字段的值","31:2"],[20,"\n","24:\"73qJ\""],[20,"\n","24:\"v1h2\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"YdKj\"|36:177"],[20,"{"],[20,"\n","24:\"yaSt\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"jgUO\"|36:177"],[20," \"sum_balance\": {"],[20,"\n","24:\"j4mW\"|36:177"],[20," \"sum\": {"],[20,"\n","24:\"kHlr\"|36:177"],[20," \"field\": \"balance\","],[20,"\n","24:\"jCYW\"|36:177"],[20," \"script\": {"],[20,"\n","24:\"n9tm\"|36:177"],[20," \"source\": \"_value * 1.03\""],[20,"\n","24:\"KUtE\"|36:177"],[20," }"],[20,"\n","24:\"YMsQ\"|36:177"],[20," }"],[20,"\n","24:\"wFBp\"|36:177"],[20," }"],[20,"\n","24:\"nYgC\"|36:177"],[20," }"],[20,"\n","24:\"cyFL\"|36:177"],[20,"}"],[20,"\n","24:\"OIpc\"|36:177"],[20,"\n","24:\"iXEw\""],[20," 结果4:","31:2"],[20,"\n","24:\"rORz\""],[20,"\n","24:\"u45A\""],[20,"{"],[20,"\n","24:\"AvAD\"|36:177"],[20," \"took\": 165,"],[20,"\n","24:\"A2wY\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"kqBx\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"bvew\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"RylA\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"HIIP\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"wUb7\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"LK6m\"|36:177"],[20," },"],[20,"\n","24:\"7TMf\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"s1Cd\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"kHPI\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"DppR\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"qyrC\"|36:177"],[20," },"],[20,"\n","24:\"dGqR\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"ock4\"|36:177"],[20," \"sum_balance\": {"],[20,"\n","24:\"2O0E\"|36:177"],[20," \"value\": 26486282.11"],[20,"\n","24:\"aIGg\"|36:177"],[20," }"],[20,"\n","24:\"ZMnV\"|36:177"],[20," }"],[20,"\n","24:\"0nL2\"|36:177"],[20,"}"],[20,"\n","24:\"QRRp\"|36:177"],[20,"\n","24:\"tQTQ\""],[20," 示例5:为没有值字段指定值。如未指定,缺失该字段值的文档将被忽略。","31:2"],[20,"\n","24:\"UY6y\""],[20,"\n","24:\"QUVA\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"zeOl\"|36:177"],[20,"{"],[20,"\n","24:\"kbyj\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"sMDU\"|36:177"],[20," \"avg_age\": {"],[20,"\n","24:\"oNJO\"|36:177"],[20," \"avg\": {"],[20,"\n","24:\"K7Dc\"|36:177"],[20," \"field\": \"age\","],[20,"\n","24:\"ycuQ\"|36:177"],[20," \"missing\": 18"],[20,"\n","24:\"SaTg\"|36:177"],[20," }"],[20,"\n","24:\"jXQd\"|36:177"],[20," }"],[20,"\n","24:\"hPue\"|36:177"],[20," }"],[20,"\n","24:\"1asV\"|36:177"],[20,"}"],[20,"\n","24:\"b2eR\"|36:177"],[20,"\n","24:\"uH85\""],[20," 2. 文档计数 count","27:\"12\"|31:2"],[20,"\n","24:\"6TPs\"|32:3|linespacing:\"150\""],[20," 示例1:统计银行索引bank下年龄为24的文档数量","31:2"],[20,"\n","24:\"exlZ\""],[20,"\n","24:\"mAsn\""],[20,"POST /bank/_doc/_count"],[20,"\n","24:\"c9QS\"|36:177"],[20,"{"],[20,"\n","24:\"oojN\"|36:177"],[20," \"query\": {"],[20,"\n","24:\"r0rE\"|36:177"],[20," \"match\": {"],[20,"\n","24:\"lwmS\"|36:177"],[20," \"age\" : 24"],[20,"\n","24:\"ShLY\"|36:177"],[20," }"],[20,"\n","24:\"qQlR\"|36:177"],[20," }"],[20,"\n","24:\"ilcS\"|36:177"],[20,"}"],[20,"\n","24:\"R06A\"|36:177"],[20,"\n","24:\"r31q\""],[20," 结果1:","31:2"],[20,"\n","24:\"O6lt\""],[20,"{"],[20,"\n","24:\"gmDW\"|36:177"],[20," \"count\": 42,"],[20,"\n","24:\"zOPO\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"g9BI\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"ACks\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"c70W\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"Gtm7\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"vwh6\"|36:177"],[20," }"],[20,"\n","24:\"fWhV\"|36:177"],[20,"}"],[20,"\n","24:\"LYGI\"|36:177"],[20," 3. Value count 统计某字段有值的文档数","27:\"12\"|31:2"],[20,"\n","24:\"lCsb\"|32:3|linespacing:\"150\""],[20,"示例1:","31:2"],[20,"\n","24:\"kGan\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"PXOL\"|36:177"],[20,"{"],[20,"\n","24:\"6uwC\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"T8MG\"|36:177"],[20," \"age_count\": {"],[20,"\n","24:\"61Gy\"|36:177"],[20," \"value_count\": {"],[20,"\n","24:\"h1pQ\"|36:177"],[20," \"field\": \"age\""],[20,"\n","24:\"WQ2G\"|36:177"],[20," }"],[20,"\n","24:\"Mh89\"|36:177"],[20," }"],[20,"\n","24:\"Omfx\"|36:177"],[20," }"],[20,"\n","24:\"1dTP\"|36:177"],[20,"}"],[20,"\n","24:\"EICh\"|36:177"],[20,"\n","24:\"kaZr\""],[20," 结果1:","31:2"],[20,"\n","24:\"z5La\""],[20,"{"],[20,"\n","24:\"Ug6w\"|36:177"],[20," \"took\": 2022,"],[20,"\n","24:\"Pgmh\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"U4tj\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"n0fZ\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"t8GE\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"W1Bi\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"swgP\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"S3Yk\"|36:177"],[20," },"],[20,"\n","24:\"yPfP\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"JcwW\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"6lYx\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"yNuj\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"GgSp\"|36:177"],[20," },"],[20,"\n","24:\"njJK\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"hysv\"|36:177"],[20," \"age_count\": {"],[20,"\n","24:\"AS07\"|36:177"],[20," \"value\": 1000"],[20,"\n","24:\"fJpv\"|36:177"],[20," }"],[20,"\n","24:\"L3e4\"|36:177"],[20," }"],[20,"\n","24:\"wJT2\"|36:177"],[20,"}"],[20,"\n","24:\"Laa3\"|36:177"],[20," 4. cardinality  值去重计数","27:\"12\"|31:2"],[20,"\n","24:\"3n7X\"|32:3|linespacing:\"150\""],[20,"示例1","31:2"],[20,"\n","24:\"WYzn\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"rFmZ\"|36:177"],[20,"{"],[20,"\n","24:\"R3qI\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"6u8K\"|36:177"],[20," \"age_count\": {"],[20,"\n","24:\"9HcK\"|36:177"],[20," \"cardinality\": {"],[20,"\n","24:\"bm3H\"|36:177"],[20," \"field\": \"age\""],[20,"\n","24:\"3m40\"|36:177"],[20," }"],[20,"\n","24:\"HX5w\"|36:177"],[20," },"],[20,"\n","24:\"ls2s\"|36:177"],[20," \"state_count\": {"],[20,"\n","24:\"QSqO\"|36:177"],[20," \"cardinality\": {"],[20,"\n","24:\"GLKH\"|36:177"],[20," \"field\": \"state.keyword\""],[20,"\n","24:\"iVdA\"|36:177"],[20," }"],[20,"\n","24:\"qLUJ\"|36:177"],[20," }"],[20,"\n","24:\"QzBc\"|36:177"],[20," }"],[20,"\n","24:\"FhVd\"|36:177"],[20,"}"],[20,"\n","24:\"GuuK\"|36:177"],[20,"\n","24:\"G0ZV\""],[20," 说明:state的使用它的keyword版","0:\"%23ff0000\"|31:2|8:1"],[20,"\n","24:\"fd1i\""],[20," 结果1:","31:2"],[20,"\n","24:\"4tE5\""],[20,"\n","24:\"mGji\""],[20,"{"],[20,"\n","24:\"2exz\"|36:177"],[20," \"took\": 2074,"],[20,"\n","24:\"Oufd\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"W5ud\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"xcKv\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"Ee1Q\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"tTx8\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"MF3A\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"qKh1\"|36:177"],[20," },"],[20,"\n","24:\"cFZy\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"fZV6\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"IazR\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"kRwc\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"roaa\"|36:177"],[20," },"],[20,"\n","24:\"OwrY\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"P3uC\"|36:177"],[20," \"state_count\": {"],[20,"\n","24:\"WVUt\"|36:177"],[20," \"value\": 51"],[20,"\n","24:\"t1Ql\"|36:177"],[20," },"],[20,"\n","24:\"J463\"|36:177"],[20," \"age_count\": {"],[20,"\n","24:\"9MLr\"|36:177"],[20," \"value\": 21"],[20,"\n","24:\"g7gg\"|36:177"],[20," }"],[20,"\n","24:\"cslx\"|36:177"],[20," }"],[20,"\n","24:\"7ZsR\"|36:177"],[20,"}"],[20,"\n","24:\"6Rl2\"|36:177"],[20," 5. stats 统计 count max min avg sum 5个值","27:\"12\"|31:2"],[20,"\n","24:\"T6tj\"|32:3|linespacing:\"150\""],[20," 示例1:","31:2"],[20,"\n","24:\"KKAT\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"VI9T\"|36:177"],[20,"{"],[20,"\n","24:\"PefW\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"Iq0j\"|36:177"],[20," \"age_stats\": {"],[20,"\n","24:\"9fxI\"|36:177"],[20," \"stats\": {"],[20,"\n","24:\"LdHX\"|36:177"],[20," \"field\": \"age\""],[20,"\n","24:\"Npo7\"|36:177"],[20," }"],[20,"\n","24:\"CGeJ\"|36:177"],[20," }"],[20,"\n","24:\"wuue\"|36:177"],[20," }"],[20,"\n","24:\"Ou4o\"|36:177"],[20,"}"],[20,"\n","24:\"BxCf\"|36:177"],[20,{"gallery":"https://assets.smcdn.cn/docs/assets/paste_error_placeholder-b6c71c3140.png"},"29:0|30:0|3:\"auto\"|4:\"auto\"|crop:\"\"|frame:\"none\"|ori-height:\"447\"|ori-width:\"612\""],[20,"\n","24:\"tH8f\""],[20," 结果1:","31:2"],[20,"\n","24:\"3jLY\""],[20,{"gallery":"https://assets.smcdn.cn/docs/assets/paste_error_placeholder-b6c71c3140.png"},"29:0|30:0|3:\"auto\"|4:\"auto\"|crop:\"\"|frame:\"none\"|ori-height:\"447\"|ori-width:\"612\""],[20,"\n","24:\"HYbN\""],[20,"{"],[20,"\n","24:\"U8WC\"|36:177"],[20," \"took\": 7,"],[20,"\n","24:\"SeL2\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"1hPq\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"Db8Q\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"rgfA\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"4jK7\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"W8GG\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"7rA6\"|36:177"],[20," },"],[20,"\n","24:\"0tWK\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"fBCj\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"5oQF\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"P5RM\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"bwCX\"|36:177"],[20," },"],[20,"\n","24:\"rWyP\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"STY7\"|36:177"],[20," \"age_stats\": {"],[20,"\n","24:\"nEjE\"|36:177"],[20," \"count\": 1000,"],[20,"\n","24:\"FP5H\"|36:177"],[20," \"min\": 20,"],[20,"\n","24:\"FT0Z\"|36:177"],[20," \"max\": 40,"],[20,"\n","24:\"a1lv\"|36:177"],[20," \"avg\": 30.171,"],[20,"\n","24:\"97eR\"|36:177"],[20," \"sum\": 30171"],[20,"\n","24:\"inxZ\"|36:177"],[20," }"],[20,"\n","24:\"uM96\"|36:177"],[20," }"],[20,"\n","24:\"sO0M\"|36:177"],[20,"}"],[20,"\n","24:\"2Duv\"|36:177"],[20,{"gallery":"https://assets.smcdn.cn/docs/assets/paste_error_placeholder-b6c71c3140.png"},"29:0|30:0|3:\"auto\"|4:\"auto\"|crop:\"\"|frame:\"none\"|ori-height:\"447\"|ori-width:\"612\""],[20,"\n","24:\"k4Vq\""],[20," 6. Extended stats","27:\"12\"|31:2"],[20,"\n","24:\"UvGq\"|32:3|linespacing:\"150\""],[20,"高级统计,比stats多4个统计结果: 平方和、方差、标准差、平均值加/减两个标准差的区间","31:2"],[20,"\n","24:\"httE\""],[20," 示例1:","31:2"],[20,"\n","24:\"yKiU\""],[20,{"gallery":"https://assets.smcdn.cn/docs/assets/paste_error_placeholder-b6c71c3140.png"},"29:0|30:0|3:\"auto\"|4:\"auto\"|crop:\"\"|frame:\"none\"|ori-height:\"447\"|ori-width:\"612\""],[20,"\n","24:\"xm30\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"wDB0\"|36:177"],[20,"{"],[20,"\n","24:\"JI1r\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"rqbb\"|36:177"],[20," \"age_stats\": {"],[20,"\n","24:\"q9ei\"|36:177"],[20," \"extended_stats\": {"],[20,"\n","24:\"YGrG\"|36:177"],[20," \"field\": \"age\""],[20,"\n","24:\"jXUl\"|36:177"],[20," }"],[20,"\n","24:\"pEGF\"|36:177"],[20," }"],[20,"\n","24:\"HLVJ\"|36:177"],[20," }"],[20,"\n","24:\"Z8x6\"|36:177"],[20,"}"],[20,"\n","24:\"jMqm\"|36:177"],[20,{"gallery":"https://assets.smcdn.cn/docs/assets/paste_error_placeholder-b6c71c3140.png"},"29:0|30:0|3:\"auto\"|4:\"auto\"|crop:\"\"|frame:\"none\"|ori-height:\"447\"|ori-width:\"612\""],[20,"\n","24:\"hPZP\""],[20," 结果1:","31:2"],[20,"\n","24:\"mnYH\""],[20,{"gallery":"https://assets.smcdn.cn/docs/assets/paste_error_placeholder-b6c71c3140.png"},"29:0|30:0|3:\"auto\"|4:\"auto\"|crop:\"\"|frame:\"none\"|ori-height:\"447\"|ori-width:\"612\""],[20,"\n","24:\"uv4r\""],[20,"{"],[20,"\n","24:\"5trf\"|36:177"],[20," \"took\": 7,"],[20,"\n","24:\"eVwD\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"yw4l\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"vvG6\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"5zkG\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"1Ml9\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"3gaM\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"vbNB\"|36:177"],[20," },"],[20,"\n","24:\"Lmiu\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"nuw0\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"ehTL\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"Da4X\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"bPe2\"|36:177"],[20," },"],[20,"\n","24:\"QnUz\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"d4C1\"|36:177"],[20," \"age_stats\": {"],[20,"\n","24:\"hCIi\"|36:177"],[20," \"count\": 1000,"],[20,"\n","24:\"Aob0\"|36:177"],[20," \"min\": 20,"],[20,"\n","24:\"twBn\"|36:177"],[20," \"max\": 40,"],[20,"\n","24:\"0xY4\"|36:177"],[20," \"avg\": 30.171,"],[20,"\n","24:\"WimT\"|36:177"],[20," \"sum\": 30171,"],[20,"\n","24:\"UrBb\"|36:177"],[20," \"sum_of_squares\": 946393,"],[20,"\n","24:\"CHt1\"|36:177"],[20," \"variance\": 36.10375899999996,"],[20,"\n","24:\"6JR8\"|36:177"],[20," \"std_deviation\": 6.008640362012022,"],[20,"\n","24:\"B7gC\"|36:177"],[20," \"std_deviation_bounds\": {"],[20,"\n","24:\"o2CW\"|36:177"],[20," \"upper\": 42.18828072402404,"],[20,"\n","24:\"cdtD\"|36:177"],[20," \"lower\": 18.153719275975956"],[20,"\n","24:\"30Nz\"|36:177"],[20," }"],[20,"\n","24:\"H5qU\"|36:177"],[20," }"],[20,"\n","24:\"9aG4\"|36:177"],[20," }"],[20,"\n","24:\"LwkT\"|36:177"],[20,"}"],[20,"\n","24:\"u2TG\"|36:177"],[20,{"gallery":"https://assets.smcdn.cn/docs/assets/paste_error_placeholder-b6c71c3140.png"},"29:0|30:0|3:\"auto\"|4:\"auto\"|crop:\"\"|frame:\"none\"|ori-height:\"447\"|ori-width:\"612\""],[20,"\n","24:\"HFml\""],[20," 7. Percentiles 占比百分位对应的值统计","27:\"12\"|31:2"],[20,"\n","24:\"oNX0\"|32:3|linespacing:\"150\""],[20,"对指定字段(脚本)的值按从小到大累计每个值对应的文档数的占比(占所有命中文档数的百分比),返回指定占比比例对应的值。默认返回[ 1, 5, 25, 50, 75, 95, 99 ]分位上的值。如下中间的结果,可以理解为:占比为50%的文档的age值 <= 31,或反过来:age<=31的文档数占总命中文档数的50%","31:2"],[20,"\n","24:\"ltad\""],[20," 示例1:","31:2"],[20,"\n","24:\"BE3Y\""],[20,{"gallery":"https://assets.smcdn.cn/docs/assets/paste_error_placeholder-b6c71c3140.png"},"29:0|30:0|3:\"auto\"|4:\"auto\"|crop:\"\"|frame:\"none\"|ori-height:\"447\"|ori-width:\"612\""],[20,"\n","24:\"K7HV\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"ehkB\"|36:177"],[20,"{"],[20,"\n","24:\"KMzg\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"jfMc\"|36:177"],[20," \"age_percents\": {"],[20,"\n","24:\"VlhB\"|36:177"],[20," \"percentiles\": {"],[20,"\n","24:\"VbDk\"|36:177"],[20," \"field\": \"age\""],[20,"\n","24:\"Yqd5\"|36:177"],[20," }"],[20,"\n","24:\"71Lt\"|36:177"],[20," }"],[20,"\n","24:\"Ibbi\"|36:177"],[20," }"],[20,"\n","24:\"snx0\"|36:177"],[20,"}"],[20,"\n","24:\"QsHx\"|36:177"],[20,"\n","24:\"Rybg\""],[20,"结果1:","31:2"],[20,"\n","24:\"4s6w\""],[20,"\n","24:\"K8yZ\""],[20,"{"],[20,"\n","24:\"pByZ\"|36:177"],[20," \"took\": 87,"],[20,"\n","24:\"hB25\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"3cR0\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"5Ee8\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"rVjo\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"p8bJ\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"t4KH\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"Fgef\"|36:177"],[20," },"],[20,"\n","24:\"mkPS\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"30wD\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"2NcD\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"R12o\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"E2ZV\"|36:177"],[20," },"],[20,"\n","24:\"ZsJf\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"EovF\"|36:177"],[20," \"age_percents\": {"],[20,"\n","24:\"rnAt\"|36:177"],[20," \"values\": {"],[20,"\n","24:\"53sK\"|36:177"],[20," \"1.0\": 20,"],[20,"\n","24:\"o4wP\"|36:177"],[20," \"5.0\": 21,"],[20,"\n","24:\"7VnH\"|36:177"],[20," \"25.0\": 25,"],[20,"\n","24:\"iuH9\"|36:177"],[20," \"50.0\": 31,"],[20,"\n","24:\"1F0g\"|36:177"],[20," \"75.0\": 35.00000000000001,"],[20,"\n","24:\"boKa\"|36:177"],[20," \"95.0\": 39,"],[20,"\n","24:\"5S4I\"|36:177"],[20," \"99.0\": 40"],[20,"\n","24:\"Eng8\"|36:177"],[20," }"],[20,"\n","24:\"6zEO\"|36:177"],[20," }"],[20,"\n","24:\"ZOVL\"|36:177"],[20," }"],[20,"\n","24:\"HAGG\"|36:177"],[20,"}"],[20,"\n","24:\"fK7K\"|36:177"],[20,"\n","24:\"LFQs\""],[20," 结果说明:","31:2"],[20,"\n","24:\"nsvT\""],[20,"占比为50%的文档的age值 <= 31,或反过来:age<=31的文档数占总命中文档数的50%","31:2"],[20,"\n","24:\"WSXQ\""],[20," 示例2:指定分位值","31:2"],[20,"\n","24:\"cVvI\""],[20,"\n","24:\"RE36\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"8EZe\"|36:177"],[20,"{"],[20,"\n","24:\"7VwT\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"bHEg\"|36:177"],[20," \"age_percents\": {"],[20,"\n","24:\"ypaa\"|36:177"],[20," \"percentiles\": {"],[20,"\n","24:\"K5LV\"|36:177"],[20," \"field\": \"age\","],[20,"\n","24:\"5hSo\"|36:177"],[20," \"percents\" : [95, 99, 99.9] "],[20,"\n","24:\"lOVr\"|36:177"],[20," }"],[20,"\n","24:\"vrYU\"|36:177"],[20," }"],[20,"\n","24:\"xg7Z\"|36:177"],[20," }"],[20,"\n","24:\"BjYF\"|36:177"],[20,"}"],[20,"\n","24:\"n0V8\"|36:177"],[20,"\n","24:\"vP40\""],[20," 结果2:","31:2"],[20,"\n","24:\"jKo2\""],[20,"\n","24:\"EokS\""],[20,"{"],[20,"\n","24:\"Z2RI\"|36:177"],[20," \"took\": 8,"],[20,"\n","24:\"andR\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"8WK9\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"28tB\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"v2mx\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"dsz4\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"8DPg\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"bnrJ\"|36:177"],[20," },"],[20,"\n","24:\"kQkt\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"SxrN\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"jY3t\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"ce2d\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"Jigt\"|36:177"],[20," },"],[20,"\n","24:\"Vvuf\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"JKmF\"|36:177"],[20," \"age_percents\": {"],[20,"\n","24:\"cmch\"|36:177"],[20," \"values\": {"],[20,"\n","24:\"pBvS\"|36:177"],[20," \"95.0\": 39,"],[20,"\n","24:\"ukha\"|36:177"],[20," \"99.0\": 40,"],[20,"\n","24:\"1tPX\"|36:177"],[20," \"99.9\": 40"],[20,"\n","24:\"X3ub\"|36:177"],[20," }"],[20,"\n","24:\"nNI1\"|36:177"],[20," }"],[20,"\n","24:\"TK9k\"|36:177"],[20," }"],[20,"\n","24:\"3NiS\"|36:177"],[20,"}"],[20,"\n","24:\"Vj8Y\"|36:177"],[20,"\n","24:\"LCUh\""],[20," 8. Percentiles rank 统计值小于等于指定值的文档占比","27:\"12\"|31:2"],[20,"\n","24:\"n9qn\"|32:3|linespacing:\"150\""],[20," 示例1:统计年龄小于25和30的文档的占比,和第7项相反","31:2"],[20,"\n","24:\"17sS\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"8ULi\"|36:177"],[20,"{"],[20,"\n","24:\"qi6O\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"gTPU\"|36:177"],[20," \"gge_perc_rank\": {"],[20,"\n","24:\"ED9q\"|36:177"],[20," \"percentile_ranks\": {"],[20,"\n","24:\"RrRN\"|36:177"],[20," \"field\": \"age\","],[20,"\n","24:\"G5om\"|36:177"],[20," \"values\": ["],[20,"\n","24:\"tOt3\"|36:177"],[20," 25,"],[20,"\n","24:\"nbdr\"|36:177"],[20," 30"],[20,"\n","24:\"PtZR\"|36:177"],[20," ]"],[20,"\n","24:\"sc1X\"|36:177"],[20," }"],[20,"\n","24:\"Spt8\"|36:177"],[20," }"],[20,"\n","24:\"upnS\"|36:177"],[20," }"],[20,"\n","24:\"0CK5\"|36:177"],[20,"}"],[20,"\n","24:\"l97t\"|36:177"],[20,"结果2:","31:2"],[20,"\n","24:\"Lwzp\""],[20,{"gallery":"https://assets.smcdn.cn/docs/assets/paste_error_placeholder-b6c71c3140.png"},"29:0|30:0|3:\"auto\"|4:\"auto\"|crop:\"\"|frame:\"none\"|ori-height:\"447\"|ori-width:\"612\""],[20,"\n","24:\"r2ak\""],[20,"{"],[20,"\n","24:\"npB1\"|36:177"],[20," \"took\": 8,"],[20,"\n","24:\"5Qf2\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"BZju\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"CDdI\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"qMmh\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"wVqf\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"SctH\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"B9Ks\"|36:177"],[20," },"],[20,"\n","24:\"5Jx9\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"4f0v\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"nI1G\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"t4v2\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"uCIt\"|36:177"],[20," },"],[20,"\n","24:\"VJsC\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"9ShG\"|36:177"],[20," \"gge_perc_rank\": {"],[20,"\n","24:\"x9K9\"|36:177"],[20," \"values\": {"],[20,"\n","24:\"92ba\"|36:177"],[20," \"25.0\": 26.1,"],[20,"\n","24:\"xDYN\"|36:177"],[20," \"30.0\": 49.2"],[20,"\n","24:\"GIxF\"|36:177"],[20," }"],[20,"\n","24:\"BHE5\"|36:177"],[20," }"],[20,"\n","24:\"yTL8\"|36:177"],[20," }"],[20,"\n","24:\"avnn\"|36:177"],[20,"}"],[20,"\n","24:\"932K\"|36:177"],[20,{"gallery":"https://assets.smcdn.cn/docs/assets/paste_error_placeholder-b6c71c3140.png"},"29:0|30:0|3:\"auto\"|4:\"auto\"|crop:\"\"|frame:\"none\"|ori-height:\"447\"|ori-width:\"612\""],[20,"\n","24:\"1yC6\""],[20," 结果说明:年龄小于25的文档占比为26.1%,年龄小于30的文档占比为49.2%,","31:2"],[20,"\n","24:\"z8OG\""],[20," 9. Geo Bounds aggregation 求文档集中的地理位置坐标点的范围","27:\"12\"|31:2"],[20,"\n","24:\"C5ew\"|32:3|linespacing:\"150\""],[20,"参考官网链接:","31:2"],[20,"\n","24:\"coyu\""],[20,"https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-geobounds-aggregation.html","16:\"https%3A%2F%2Fwww.elastic.co%2Fguide%2Fen%2Felasticsearch%2Freference%2Fcurrent%2Fsearch-aggregations-metrics-geobounds-aggregation.html\"|31:2"],[20,"\n","24:\"psz7\""],[20,"10. Geo Centroid aggregation  求地理位置中心点坐标值","27:\"12\"|31:2"],[20,"\n","24:\"0a2J\"|32:3|linespacing:\"150\""],[20,"参考官网链接:","31:2"],[20,"\n","24:\"sfTs\""],[20,"https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-geocentroid-aggregation.html","16:\"https%3A%2F%2Fwww.elastic.co%2Fguide%2Fen%2Felasticsearch%2Freference%2Fcurrent%2Fsearch-aggregations-metrics-geocentroid-aggregation.html\"|31:2"],[20,"\n","24:\"kqFG\""],[20,"三、桶聚合","27:\"16\"|31:2"],[20,"\n","24:\"O2ug\"|32:2|linespacing:\"150\""],[20,{"gallery":"https://assets.smcdn.cn/docs/assets/paste_error_placeholder-b6c71c3140.png"},"29:0|30:0|3:\"auto\"|4:\"auto\"|crop:\"\"|frame:\"none\"|ori-height:\"447\"|ori-width:\"612\""],[20,"\n","24:\"OfX4\""],[20," ","31:2"],[20,"\n","24:\"Ibd1\""],[20,"1. Terms Aggregation  根据字段值项分组聚合 ","27:\"12\"|31:2"],[20,"\n","24:\"zESh\"|32:3|linespacing:\"150\""],[20," 示例1:","31:2"],[20,"\n","24:\"LNdw\""],[20,"\n","24:\"lg9c\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"6xCD\"|36:177"],[20,"{"],[20,"\n","24:\"9bo7\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"FOlx\"|36:177"],[20," \"age_terms\": {"],[20,"\n","24:\"EVF8\"|36:177"],[20," \"terms\": {"],[20,"\n","24:\"pBb5\"|36:177"],[20," \"field\": \"age\""],[20,"\n","24:\"vfwY\"|36:177"],[20," }"],[20,"\n","24:\"XK3M\"|36:177"],[20," }"],[20,"\n","24:\"UHIG\"|36:177"],[20," }"],[20,"\n","24:\"luhg\"|36:177"],[20,"}"],[20,"\n","24:\"PPp7\"|36:177"],[20,"\n","24:\"Bmqw\""],[20," 结果1:","31:2"],[20,"\n","24:\"NrSB\""],[20,"\n","24:\"VNgr\""],[20,"{"],[20,"\n","24:\"POvq\"|36:177"],[20," \"took\": 2000,"],[20,"\n","24:\"o0o0\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"bIYh\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"ymii\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"6F2Q\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"pB8b\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"gr7r\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"jLzQ\"|36:177"],[20," },"],[20,"\n","24:\"tj7w\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"x6Oh\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"19oD\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"Sw5c\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"TVIi\"|36:177"],[20," },"],[20,"\n","24:\"raBr\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"4PCJ\"|36:177"],[20," \"age_terms\": {"],[20,"\n","24:\"1SLr\"|36:177"],[20," \"doc_count_error_upper_bound\": 0,"],[20,"\n","24:\"7qQy\"|36:177"],[20," \"sum_other_doc_count\": 463,"],[20,"\n","24:\"vReI\"|36:177"],[20," \"buckets\": ["],[20,"\n","24:\"vrSh\"|36:177"],[20," {"],[20,"\n","24:\"iMjG\"|36:177"],[20," \"key\": 31,"],[20,"\n","24:\"WT1f\"|36:177"],[20," \"doc_count\": 61"],[20,"\n","24:\"bIEU\"|36:177"],[20," },"],[20,"\n","24:\"nf5X\"|36:177"],[20," {"],[20,"\n","24:\"xDCn\"|36:177"],[20," \"key\": 39,"],[20,"\n","24:\"ZFBl\"|36:177"],[20," \"doc_count\": 60"],[20,"\n","24:\"ysKO\"|36:177"],[20," },"],[20,"\n","24:\"Rmf3\"|36:177"],[20," {"],[20,"\n","24:\"wKCs\"|36:177"],[20," \"key\": 26,"],[20,"\n","24:\"hzYP\"|36:177"],[20," \"doc_count\": 59"],[20,"\n","24:\"PvT9\"|36:177"],[20," },"],[20,"\n","24:\"SaL0\"|36:177"],[20," {"],[20,"\n","24:\"DhWZ\"|36:177"],[20," \"key\": 32,"],[20,"\n","24:\"0hCS\"|36:177"],[20," \"doc_count\": 52"],[20,"\n","24:\"Zs6L\"|36:177"],[20," },"],[20,"\n","24:\"XZOV\"|36:177"],[20," {"],[20,"\n","24:\"Gzmx\"|36:177"],[20," \"key\": 35,"],[20,"\n","24:\"u2eS\"|36:177"],[20," \"doc_count\": 52"],[20,"\n","24:\"ltg4\"|36:177"],[20," },"],[20,"\n","24:\"SAWb\"|36:177"],[20," {"],[20,"\n","24:\"tpxH\"|36:177"],[20," \"key\": 36,"],[20,"\n","24:\"gjun\"|36:177"],[20," \"doc_count\": 52"],[20,"\n","24:\"Epg0\"|36:177"],[20," },"],[20,"\n","24:\"0GZO\"|36:177"],[20," {"],[20,"\n","24:\"1Jpx\"|36:177"],[20," \"key\": 22,"],[20,"\n","24:\"0Lac\"|36:177"],[20," \"doc_count\": 51"],[20,"\n","24:\"EODY\"|36:177"],[20," },"],[20,"\n","24:\"Laqh\"|36:177"],[20," {"],[20,"\n","24:\"Rl6u\"|36:177"],[20," \"key\": 28,"],[20,"\n","24:\"CI4A\"|36:177"],[20," \"doc_count\": 51"],[20,"\n","24:\"PhCV\"|36:177"],[20," },"],[20,"\n","24:\"PcBA\"|36:177"],[20," {"],[20,"\n","24:\"nitk\"|36:177"],[20," \"key\": 33,"],[20,"\n","24:\"W5Kg\"|36:177"],[20," \"doc_count\": 50"],[20,"\n","24:\"YSGw\"|36:177"],[20," },"],[20,"\n","24:\"yS5A\"|36:177"],[20," {"],[20,"\n","24:\"v4a2\"|36:177"],[20," \"key\": 34,"],[20,"\n","24:\"mRI5\"|36:177"],[20," \"doc_count\": 49"],[20,"\n","24:\"lH4y\"|36:177"],[20," }"],[20,"\n","24:\"bNjT\"|36:177"],[20," ]"],[20,"\n","24:\"4Trs\"|36:177"],[20," }"],[20,"\n","24:\"eRBm\"|36:177"],[20," }"],[20,"\n","24:\"B6V9\"|36:177"],[20,"}"],[20,"\n","24:\"NM2q\"|36:177"],[20,"\n","24:\"vMaR\""],[20," 结果说明:","31:2"],[20,"\n","24:\"tuoY\""],[20,"\"doc_count_error_upper_bound\": 0:文档计数的最大偏差值","31:2"],[20,"\n","24:\"xEAP\""],[20,"\"sum_other_doc_count\": 463:未返回的其他项的文档数","31:2"],[20,"\n","24:\"sGWc\""],[20,"默认情况下返回按文档计数从高到低的前10个分组:","31:2"],[20,"\n","24:\"MaM3\""],[20,"\n","24:\"LcNL\""],[20," \"buckets\": ["],[20,"\n","24:\"xqyt\"|36:177"],[20," {"],[20,"\n","24:\"wSrT\"|36:177"],[20," \"key\": 31,"],[20,"\n","24:\"6YCl\"|36:177"],[20," \"doc_count\": 61"],[20,"\n","24:\"sGMs\"|36:177"],[20," },"],[20,"\n","24:\"9kk4\"|36:177"],[20," {"],[20,"\n","24:\"Hxcp\"|36:177"],[20," \"key\": 39,"],[20,"\n","24:\"4u5v\"|36:177"],[20," \"doc_count\": 60"],[20,"\n","24:\"ALVv\"|36:177"],[20," },"],[20,"\n","24:\"dx30\"|36:177"],[20," ............."],[20,"\n","24:\"HPWD\"|36:177"],[20,"]"],[20,"\n","24:\"88Ua\"|36:177"],[20,"\n","24:\"lfFc\""],[20," 年龄为31的文档有61个,年龄为39的文档有60个","31:2"],[20,"\n","24:\"Etdh\""],[20," size 指定返回多少个分组:","31:2|8:1"],[20,"\n","24:\"tmj7\""],[20,"示例2:指定返回20个分组","31:2"],[20,"\n","24:\"6lpL\""],[20,"\n","24:\"zBAi\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"9APT\"|36:177"],[20,"{"],[20,"\n","24:\"CV7X\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"pdGK\"|36:177"],[20," \"age_terms\": {"],[20,"\n","24:\"kI1a\"|36:177"],[20," \"terms\": {"],[20,"\n","24:\"zMzx\"|36:177"],[20," \"field\": \"age\","],[20,"\n","24:\"afUe\"|36:177"],[20," \"size\": 20"],[20,"\n","24:\"cOi8\"|36:177"],[20," }"],[20,"\n","24:\"V2En\"|36:177"],[20," }"],[20,"\n","24:\"l7Oy\"|36:177"],[20," }"],[20,"\n","24:\"uzyF\"|36:177"],[20,"}"],[20,"\n","24:\"lZRk\"|36:177"],[20,"\n","24:\"hRzd\""],[20," 结果2:","31:2"],[20,"\n","24:\"jGlZ\""],[20," ","1:\"%23f5f5f5\"|27:\"9\""],[20,"View Code","1:\"%23ffffff\"|27:\"9\""],[20,"\n","24:\"NRN7\""],[20," 示例3:每个分组上显示偏差值","31:2"],[20,"\n","24:\"lImp\""],[20,"\n","24:\"N8GX\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"f6ju\"|36:177"],[20,"{"],[20,"\n","24:\"NoQP\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"ERPy\"|36:177"],[20," \"age_terms\": {"],[20,"\n","24:\"1PxX\"|36:177"],[20," \"terms\": {"],[20,"\n","24:\"RDG6\"|36:177"],[20," \"field\": \"age\","],[20,"\n","24:\"iWfj\"|36:177"],[20," \"size\": 5,"],[20,"\n","24:\"4xkX\"|36:177"],[20," \"shard_size\": 20,"],[20,"\n","24:\"zeY3\"|36:177"],[20," \"show_term_doc_count_error\": true"],[20,"\n","24:\"Zrxh\"|36:177"],[20," }"],[20,"\n","24:\"WJah\"|36:177"],[20," }"],[20,"\n","24:\"M0yX\"|36:177"],[20," }"],[20,"\n","24:\"KiGu\"|36:177"],[20,"}"],[20,"\n","24:\"bydm\"|36:177"],[20,"\n","24:\"YI9V\""],[20," 结果3:","31:2"],[20,"\n","24:\"lZes\""],[20,"\n","24:\"vSKx\""],[20,"{"],[20,"\n","24:\"lEcu\"|36:177"],[20," \"took\": 8,"],[20,"\n","24:\"WBZH\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"dAID\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"NQ7f\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"lSmG\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"hmOO\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"21fn\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"xZFX\"|36:177"],[20," },"],[20,"\n","24:\"pJBx\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"weqC\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"NnFA\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"bEKX\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"sc02\"|36:177"],[20," },"],[20,"\n","24:\"mkAj\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"DD8u\"|36:177"],[20," \"age_terms\": {"],[20,"\n","24:\"k3p6\"|36:177"],[20," \"doc_count_error_upper_bound\": 25,"],[20,"\n","24:\"SZuW\"|36:177"],[20," \"sum_other_doc_count\": 716,"],[20,"\n","24:\"t447\"|36:177"],[20," \"buckets\": ["],[20,"\n","24:\"gNY3\"|36:177"],[20," {"],[20,"\n","24:\"Ha4k\"|36:177"],[20," \"key\": 31,"],[20,"\n","24:\"J41W\"|36:177"],[20," \"doc_count\": 61,"],[20,"\n","24:\"xSXo\"|36:177"],[20," \"doc_count_error_upper_bound\": 0"],[20,"\n","24:\"aje0\"|36:177"],[20," },"],[20,"\n","24:\"924l\"|36:177"],[20," {"],[20,"\n","24:\"Fg9t\"|36:177"],[20," \"key\": 39,"],[20,"\n","24:\"fevj\"|36:177"],[20," \"doc_count\": 60,"],[20,"\n","24:\"ydaW\"|36:177"],[20," \"doc_count_error_upper_bound\": 0"],[20,"\n","24:\"49lP\"|36:177"],[20," },"],[20,"\n","24:\"BWxn\"|36:177"],[20," {"],[20,"\n","24:\"JkJI\"|36:177"],[20," \"key\": 26,"],[20,"\n","24:\"w4FS\"|36:177"],[20," \"doc_count\": 59,"],[20,"\n","24:\"PxMg\"|36:177"],[20," \"doc_count_error_upper_bound\": 0"],[20,"\n","24:\"ivz3\"|36:177"],[20," },"],[20,"\n","24:\"MMRQ\"|36:177"],[20," {"],[20,"\n","24:\"afHy\"|36:177"],[20," \"key\": 32,"],[20,"\n","24:\"hO03\"|36:177"],[20," \"doc_count\": 52,"],[20,"\n","24:\"HzCY\"|36:177"],[20," \"doc_count_error_upper_bound\": 0"],[20,"\n","24:\"1rGV\"|36:177"],[20," },"],[20,"\n","24:\"0zIn\"|36:177"],[20," {"],[20,"\n","24:\"nFoA\"|36:177"],[20," \"key\": 36,"],[20,"\n","24:\"aenf\"|36:177"],[20," \"doc_count\": 52,"],[20,"\n","24:\"V3yH\"|36:177"],[20," \"doc_count_error_upper_bound\": 0"],[20,"\n","24:\"9cXl\"|36:177"],[20," }"],[20,"\n","24:\"B6PN\"|36:177"],[20," ]"],[20,"\n","24:\"vDHF\"|36:177"],[20," }"],[20,"\n","24:\"UyjO\"|36:177"],[20," }"],[20,"\n","24:\"IcVy\"|36:177"],[20,"}"],[20,"\n","24:\"xGmD\"|36:177"],[20,"\n","24:\"1JIQ\""],[20," 示例4:shard_size 指定每个分片上返回多少个分组","31:2"],[20,"\n","24:\"1oTH\""],[20,"shard_size 的默认值为:","31:2"],[20,"\n","24:\"KYEL\""],[20,"索引只有一个分片:= size","31:2"],[20,"\n","24:\"rJx7\""],[20,"多分片:= size * 1.5 + 10","31:2"],[20,"\n","24:\"b6P0\""],[20,"\n","24:\"DgaE\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"QN4T\"|36:177"],[20,"{"],[20,"\n","24:\"v7VO\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"HQ2R\"|36:177"],[20," \"age_terms\": {"],[20,"\n","24:\"34ol\"|36:177"],[20," \"terms\": {"],[20,"\n","24:\"aFXX\"|36:177"],[20," \"field\": \"age\","],[20,"\n","24:\"uhR8\"|36:177"],[20," \"size\": 5,"],[20,"\n","24:\"MRVX\"|36:177"],[20," \"shard_size\": 20"],[20,"\n","24:\"iVDB\"|36:177"],[20," }"],[20,"\n","24:\"vwSw\"|36:177"],[20," }"],[20,"\n","24:\"4w5u\"|36:177"],[20," }"],[20,"\n","24:\"RVvY\"|36:177"],[20,"}"],[20,"\n","24:\"cux0\"|36:177"],[20,"\n","24:\"jEFg\""],[20," 结果4:","31:2"],[20,"\n","24:\"30K3\""],[20,"\n","24:\"LBPk\""],[20,"{"],[20,"\n","24:\"0aWR\"|36:177"],[20," \"took\": 8,"],[20,"\n","24:\"Vk2Z\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"pigQ\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"Khhs\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"T66x\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"GxDH\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"buyQ\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"qJLz\"|36:177"],[20," },"],[20,"\n","24:\"hsaD\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"JNHf\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"t9te\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"M0k3\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"BxoO\"|36:177"],[20," },"],[20,"\n","24:\"pHbZ\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"xPo3\"|36:177"],[20," \"age_terms\": {"],[20,"\n","24:\"EBDZ\"|36:177"],[20," \"doc_count_error_upper_bound\": 25,"],[20,"\n","24:\"13Op\"|36:177"],[20," \"sum_other_doc_count\": 716,"],[20,"\n","24:\"pccp\"|36:177"],[20," \"buckets\": ["],[20,"\n","24:\"yq2Y\"|36:177"],[20," {"],[20,"\n","24:\"mN4g\"|36:177"],[20," \"key\": 31,"],[20,"\n","24:\"OOoE\"|36:177"],[20," \"doc_count\": 61"],[20,"\n","24:\"Ivco\"|36:177"],[20," },"],[20,"\n","24:\"tJhi\"|36:177"],[20," {"],[20,"\n","24:\"mTG0\"|36:177"],[20," \"key\": 39,"],[20,"\n","24:\"2aCV\"|36:177"],[20," \"doc_count\": 60"],[20,"\n","24:\"KrEf\"|36:177"],[20," },"],[20,"\n","24:\"Xo5L\"|36:177"],[20," {"],[20,"\n","24:\"SaZn\"|36:177"],[20," \"key\": 26,"],[20,"\n","24:\"SU7T\"|36:177"],[20," \"doc_count\": 59"],[20,"\n","24:\"U9si\"|36:177"],[20," },"],[20,"\n","24:\"TncJ\"|36:177"],[20," {"],[20,"\n","24:\"Ti2G\"|36:177"],[20," \"key\": 32,"],[20,"\n","24:\"IBdE\"|36:177"],[20," \"doc_count\": 52"],[20,"\n","24:\"RagB\"|36:177"],[20," },"],[20,"\n","24:\"qicH\"|36:177"],[20," {"],[20,"\n","24:\"kpYi\"|36:177"],[20," \"key\": 36,"],[20,"\n","24:\"s61V\"|36:177"],[20," \"doc_count\": 52"],[20,"\n","24:\"u0FS\"|36:177"],[20," }"],[20,"\n","24:\"IbbM\"|36:177"],[20," ]"],[20,"\n","24:\"HBVx\"|36:177"],[20," }"],[20,"\n","24:\"ZVME\"|36:177"],[20," }"],[20,"\n","24:\"nWL9\"|36:177"],[20,"}"],[20,"\n","24:\"wyY5\"|36:177"],[20,"\n","24:\"DVrV\""],[20," order  指定分组的排序","31:2|8:1"],[20,"\n","24:\"pEvI\""],[20," 示例5:根据文档计数排序","31:2"],[20,"\n","24:\"361v\""],[20,"\n","24:\"9mQf\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"XRPE\"|36:177"],[20,"{"],[20,"\n","24:\"Qz9J\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"Auo5\"|36:177"],[20," \"age_terms\": {"],[20,"\n","24:\"Lupx\"|36:177"],[20," \"terms\": {"],[20,"\n","24:\"H4t3\"|36:177"],[20," \"field\": \"age\","],[20,"\n","24:\"p7Ye\"|36:177"],[20," \"order\" : { \"_count\" : \"asc\" }"],[20,"\n","24:\"Y0xt\"|36:177"],[20," }"],[20,"\n","24:\"7YM9\"|36:177"],[20," }"],[20,"\n","24:\"YYnD\"|36:177"],[20," }"],[20,"\n","24:\"pRq2\"|36:177"],[20,"}"],[20,"\n","24:\"DuGJ\"|36:177"],[20,"\n","24:\"JUuX\""],[20," 结果5:","31:2"],[20,"\n","24:\"KYVn\""],[20,"\n","24:\"w9dE\""],[20,"{"],[20,"\n","24:\"SiKB\"|36:177"],[20," \"took\": 3,"],[20,"\n","24:\"og0O\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"qwQ8\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"0SMs\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"HRuD\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"FloI\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"Lwz7\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"GROp\"|36:177"],[20," },"],[20,"\n","24:\"744x\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"EF7a\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"rfBm\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"airX\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"AS3o\"|36:177"],[20," },"],[20,"\n","24:\"UiYE\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"8MLq\"|36:177"],[20," \"age_terms\": {"],[20,"\n","24:\"bikf\"|36:177"],[20," \"doc_count_error_upper_bound\": 0,"],[20,"\n","24:\"3EHj\"|36:177"],[20," \"sum_other_doc_count\": 584,"],[20,"\n","24:\"tvKM\"|36:177"],[20," \"buckets\": ["],[20,"\n","24:\"RycI\"|36:177"],[20," {"],[20,"\n","24:\"K2iT\"|36:177"],[20," \"key\": 29,"],[20,"\n","24:\"kdsP\"|36:177"],[20," \"doc_count\": 35"],[20,"\n","24:\"lqqn\"|36:177"],[20," },"],[20,"\n","24:\"PdEe\"|36:177"],[20," {"],[20,"\n","24:\"60lp\"|36:177"],[20," \"key\": 27,"],[20,"\n","24:\"gnh2\"|36:177"],[20," \"doc_count\": 39"],[20,"\n","24:\"Mh35\"|36:177"],[20," },"],[20,"\n","24:\"fU53\"|36:177"],[20," {"],[20,"\n","24:\"YhQb\"|36:177"],[20," \"key\": 38,"],[20,"\n","24:\"p7NY\"|36:177"],[20," \"doc_count\": 39"],[20,"\n","24:\"wxIk\"|36:177"],[20," },"],[20,"\n","24:\"8dpM\"|36:177"],[20," {"],[20,"\n","24:\"xXtx\"|36:177"],[20," \"key\": 23,"],[20,"\n","24:\"BP7O\"|36:177"],[20," \"doc_count\": 42"],[20,"\n","24:\"8sBC\"|36:177"],[20," },"],[20,"\n","24:\"GNNU\"|36:177"],[20," {"],[20,"\n","24:\"gPBj\"|36:177"],[20," \"key\": 24,"],[20,"\n","24:\"pzsv\"|36:177"],[20," \"doc_count\": 42"],[20,"\n","24:\"jVWj\"|36:177"],[20," },"],[20,"\n","24:\"OHhv\"|36:177"],[20," {"],[20,"\n","24:\"Ch31\"|36:177"],[20," \"key\": 25,"],[20,"\n","24:\"coZj\"|36:177"],[20," \"doc_count\": 42"],[20,"\n","24:\"LARJ\"|36:177"],[20," },"],[20,"\n","24:\"mm6f\"|36:177"],[20," {"],[20,"\n","24:\"Xtbc\"|36:177"],[20," \"key\": 37,"],[20,"\n","24:\"XSNa\"|36:177"],[20," \"doc_count\": 42"],[20,"\n","24:\"yEeY\"|36:177"],[20," },"],[20,"\n","24:\"lkCc\"|36:177"],[20," {"],[20,"\n","24:\"Qhny\"|36:177"],[20," \"key\": 20,"],[20,"\n","24:\"O7WU\"|36:177"],[20," \"doc_count\": 44"],[20,"\n","24:\"us5c\"|36:177"],[20," },"],[20,"\n","24:\"WX5w\"|36:177"],[20," {"],[20,"\n","24:\"5Xr4\"|36:177"],[20," \"key\": 40,"],[20,"\n","24:\"B20c\"|36:177"],[20," \"doc_count\": 45"],[20,"\n","24:\"BAPK\"|36:177"],[20," },"],[20,"\n","24:\"mXs0\"|36:177"],[20," {"],[20,"\n","24:\"Ru5G\"|36:177"],[20," \"key\": 21,"],[20,"\n","24:\"DN6U\"|36:177"],[20," \"doc_count\": 46"],[20,"\n","24:\"1i2b\"|36:177"],[20," }"],[20,"\n","24:\"hfUC\"|36:177"],[20," ]"],[20,"\n","24:\"2rmY\"|36:177"],[20," }"],[20,"\n","24:\"4uTv\"|36:177"],[20," }"],[20,"\n","24:\"E8TO\"|36:177"],[20,"}"],[20,"\n","24:\"bN9k\"|36:177"],[20,"\n","24:\"wXqB\""],[20," 示例6:根据分组值排序","31:2"],[20,"\n","24:\"EUGC\""],[20,"\n","24:\"0ujK\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"lL3p\"|36:177"],[20,"{"],[20,"\n","24:\"V84D\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"QHJm\"|36:177"],[20," \"age_terms\": {"],[20,"\n","24:\"PmEB\"|36:177"],[20," \"terms\": {"],[20,"\n","24:\"LOjZ\"|36:177"],[20," \"field\": \"age\","],[20,"\n","24:\"Wsam\"|36:177"],[20," \"order\" : { \"_key\" : \"asc\" }"],[20,"\n","24:\"Z5vz\"|36:177"],[20," }"],[20,"\n","24:\"FxuZ\"|36:177"],[20," }"],[20,"\n","24:\"4uo8\"|36:177"],[20," }"],[20,"\n","24:\"Puo5\"|36:177"],[20,"}"],[20,"\n","24:\"6ega\"|36:177"],[20,"\n","24:\"7lyW\""],[20," 结果6:","31:2"],[20,"\n","24:\"EUe0\""],[20,"\n","24:\"D8rx\""],[20,"{"],[20,"\n","24:\"XmR3\"|36:177"],[20," \"took\": 10,"],[20,"\n","24:\"bwiY\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"pICy\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"eVSB\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"jwUm\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"qGEn\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"OVyo\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"liwB\"|36:177"],[20," },"],[20,"\n","24:\"QUPS\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"vHKG\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"5Shd\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"90HV\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"d5B3\"|36:177"],[20," },"],[20,"\n","24:\"8N31\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"0aZ0\"|36:177"],[20," \"age_terms\": {"],[20,"\n","24:\"Iy1O\"|36:177"],[20," \"doc_count_error_upper_bound\": 0,"],[20,"\n","24:\"M6QP\"|36:177"],[20," \"sum_other_doc_count\": 549,"],[20,"\n","24:\"lVZ9\"|36:177"],[20," \"buckets\": ["],[20,"\n","24:\"F8AQ\"|36:177"],[20," {"],[20,"\n","24:\"jbZ1\"|36:177"],[20," \"key\": 20,"],[20,"\n","24:\"yHTQ\"|36:177"],[20," \"doc_count\": 44"],[20,"\n","24:\"eskj\"|36:177"],[20," },"],[20,"\n","24:\"ZTXL\"|36:177"],[20," {"],[20,"\n","24:\"0KcQ\"|36:177"],[20," \"key\": 21,"],[20,"\n","24:\"4UTe\"|36:177"],[20," \"doc_count\": 46"],[20,"\n","24:\"U8TW\"|36:177"],[20," },"],[20,"\n","24:\"lsaK\"|36:177"],[20," {"],[20,"\n","24:\"LZjc\"|36:177"],[20," \"key\": 22,"],[20,"\n","24:\"Voyl\"|36:177"],[20," \"doc_count\": 51"],[20,"\n","24:\"F46A\"|36:177"],[20," },"],[20,"\n","24:\"7WFg\"|36:177"],[20," {"],[20,"\n","24:\"AqHo\"|36:177"],[20," \"key\": 23,"],[20,"\n","24:\"UkXk\"|36:177"],[20," \"doc_count\": 42"],[20,"\n","24:\"NMgz\"|36:177"],[20," },"],[20,"\n","24:\"zqsL\"|36:177"],[20," {"],[20,"\n","24:\"Gcxu\"|36:177"],[20," \"key\": 24,"],[20,"\n","24:\"5kFy\"|36:177"],[20," \"doc_count\": 42"],[20,"\n","24:\"6Wsx\"|36:177"],[20," },"],[20,"\n","24:\"gsEd\"|36:177"],[20," {"],[20,"\n","24:\"nYHM\"|36:177"],[20," \"key\": 25,"],[20,"\n","24:\"2EwL\"|36:177"],[20," \"doc_count\": 42"],[20,"\n","24:\"0C0v\"|36:177"],[20," },"],[20,"\n","24:\"yVQF\"|36:177"],[20," {"],[20,"\n","24:\"se3z\"|36:177"],[20," \"key\": 26,"],[20,"\n","24:\"GBbr\"|36:177"],[20," \"doc_count\": 59"],[20,"\n","24:\"SeIT\"|36:177"],[20," },"],[20,"\n","24:\"jhiN\"|36:177"],[20," {"],[20,"\n","24:\"1eh0\"|36:177"],[20," \"key\": 27,"],[20,"\n","24:\"8oBF\"|36:177"],[20," \"doc_count\": 39"],[20,"\n","24:\"9wbk\"|36:177"],[20," },"],[20,"\n","24:\"jM67\"|36:177"],[20," {"],[20,"\n","24:\"uZC2\"|36:177"],[20," \"key\": 28,"],[20,"\n","24:\"daV2\"|36:177"],[20," \"doc_count\": 51"],[20,"\n","24:\"UV4t\"|36:177"],[20," },"],[20,"\n","24:\"ty0U\"|36:177"],[20," {"],[20,"\n","24:\"hutF\"|36:177"],[20," \"key\": 29,"],[20,"\n","24:\"eH2P\"|36:177"],[20," \"doc_count\": 35"],[20,"\n","24:\"6Z9g\"|36:177"],[20," }"],[20,"\n","24:\"LQJN\"|36:177"],[20," ]"],[20,"\n","24:\"eek9\"|36:177"],[20," }"],[20,"\n","24:\"zXuq\"|36:177"],[20," }"],[20,"\n","24:\"kdt0\"|36:177"],[20,"}"],[20,"\n","24:\"JeRA\"|36:177"],[20,"\n","24:\"6ls6\""],[20,"示例7:取分组指标值排序","31:2"],[20,"\n","24:\"wFOQ\""],[20,"\n","24:\"WyNm\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"NEd1\"|36:177"],[20,"{"],[20,"\n","24:\"vCZz\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"7cot\"|36:177"],[20," \"age_terms\": {"],[20,"\n","24:\"qkCZ\"|36:177"],[20," \"terms\": {"],[20,"\n","24:\"SWGy\"|36:177"],[20," \"field\": \"age\","],[20,"\n","24:\"Hzxu\"|36:177"],[20," \"order\": {"],[20,"\n","24:\"zyOO\"|36:177"],[20," \"max_balance\": \"asc\""],[20,"\n","24:\"8z8S\"|36:177"],[20," }"],[20,"\n","24:\"dsxp\"|36:177"],[20," },"],[20,"\n","24:\"C6j7\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"iKq7\"|36:177"],[20," \"max_balance\": {"],[20,"\n","24:\"l61b\"|36:177"],[20," \"max\": {"],[20,"\n","24:\"DTC8\"|36:177"],[20," \"field\": \"balance\""],[20,"\n","24:\"L0P8\"|36:177"],[20," }"],[20,"\n","24:\"gh33\"|36:177"],[20," },"],[20,"\n","24:\"cV86\"|36:177"],[20," \"min_balance\": {"],[20,"\n","24:\"ehOC\"|36:177"],[20," \"min\": {"],[20,"\n","24:\"eKAQ\"|36:177"],[20," \"field\": \"balance\""],[20,"\n","24:\"bJdV\"|36:177"],[20," }"],[20,"\n","24:\"iAA1\"|36:177"],[20," }"],[20,"\n","24:\"egoR\"|36:177"],[20," }"],[20,"\n","24:\"fZ7K\"|36:177"],[20," }"],[20,"\n","24:\"t1RB\"|36:177"],[20," }"],[20,"\n","24:\"mhkH\"|36:177"],[20,"}"],[20,"\n","24:\"CLNl\"|36:177"],[20,"\n","24:\"Kl5y\""],[20," 结果7:","31:2"],[20,"\n","24:\"Zq9Z\""],[20," ","1:\"%23f5f5f5\"|27:\"9\""],[20,"View Code","1:\"%23ffffff\"|27:\"9\""],[20,"\n","24:\"eOGF\""],[20," 示例8:筛选分组-正则表达式匹配值","31:2"],[20,"\n","24:\"6QQV\""],[20,"\n","24:\"QtPH\""],[20,"GET /_search"],[20,"\n","24:\"sOrd\"|36:177"],[20,"{"],[20,"\n","24:\"E43a\"|36:177"],[20," \"aggs\" : {"],[20,"\n","24:\"OEeJ\"|36:177"],[20," \"tags\" : {"],[20,"\n","24:\"Imug\"|36:177"],[20," \"terms\" : {"],[20,"\n","24:\"Okwp\"|36:177"],[20," \"field\" : \"tags\","],[20,"\n","24:\"QcCz\"|36:177"],[20," \"include\" : \".*sport.*\","],[20,"\n","24:\"LyRB\"|36:177"],[20," \"exclude\" : \"water_.*\""],[20,"\n","24:\"1aET\"|36:177"],[20," }"],[20,"\n","24:\"ghPK\"|36:177"],[20," }"],[20,"\n","24:\"SWqP\"|36:177"],[20," }"],[20,"\n","24:\"bW4Q\"|36:177"],[20,"}"],[20,"\n","24:\"wcf7\"|36:177"],[20,"\n","24:\"CtAF\""],[20," 示例9:筛选分组-指定值列表","31:2"],[20,"\n","24:\"5PXR\""],[20,"\n","24:\"AClV\""],[20,"GET /_search"],[20,"\n","24:\"YaWh\"|36:177"],[20,"{"],[20,"\n","24:\"Hkfm\"|36:177"],[20," \"aggs\" : {"],[20,"\n","24:\"CoGz\"|36:177"],[20," \"JapaneseCars\" : {"],[20,"\n","24:\"NULW\"|36:177"],[20," \"terms\" : {"],[20,"\n","24:\"hMgi\"|36:177"],[20," \"field\" : \"make\","],[20,"\n","24:\"3N7V\"|36:177"],[20," \"include\" : [\"mazda\", \"honda\"]"],[20,"\n","24:\"TJoU\"|36:177"],[20," }"],[20,"\n","24:\"0bim\"|36:177"],[20," },"],[20,"\n","24:\"WVPo\"|36:177"],[20," \"ActiveCarManufacturers\" : {"],[20,"\n","24:\"IYHP\"|36:177"],[20," \"terms\" : {"],[20,"\n","24:\"Ql4g\"|36:177"],[20," \"field\" : \"make\","],[20,"\n","24:\"gcXt\"|36:177"],[20," \"exclude\" : [\"rover\", \"jensen\"]"],[20,"\n","24:\"XyQJ\"|36:177"],[20," }"],[20,"\n","24:\"ukdv\"|36:177"],[20," }"],[20,"\n","24:\"gdet\"|36:177"],[20," }"],[20,"\n","24:\"HFiC\"|36:177"],[20,"}"],[20,"\n","24:\"wknA\"|36:177"],[20,"\n","24:\"bfa5\""],[20," 示例10:根据脚本计算值分组","31:2"],[20,"\n","24:\"YC7C\""],[20,"\n","24:\"7RKV\""],[20,"GET /_search"],[20,"\n","24:\"CvNi\"|36:177"],[20,"{"],[20,"\n","24:\"eRm1\"|36:177"],[20," \"aggs\" : {"],[20,"\n","24:\"tdzc\"|36:177"],[20," \"genres\" : {"],[20,"\n","24:\"UyEl\"|36:177"],[20," \"terms\" : {"],[20,"\n","24:\"X6tk\"|36:177"],[20," \"script\" : {"],[20,"\n","24:\"NIHx\"|36:177"],[20," \"source\": \"doc['genre'].value\","],[20,"\n","24:\"HjY8\"|36:177"],[20," \"lang\": \"painless\""],[20,"\n","24:\"7S0d\"|36:177"],[20," }"],[20,"\n","24:\"Aj7s\"|36:177"],[20," }"],[20,"\n","24:\"GKO4\"|36:177"],[20," }"],[20,"\n","24:\"0PSy\"|36:177"],[20," }"],[20,"\n","24:\"ha9Z\"|36:177"],[20,"}"],[20,"\n","24:\"TU1w\"|36:177"],[20,"\n","24:\"2txU\""],[20," 示例1:缺失值处理","31:2"],[20,"\n","24:\"Z2D7\""],[20,{"gallery":"https://assets.smcdn.cn/docs/assets/paste_error_placeholder-b6c71c3140.png"},"29:0|30:0|3:\"auto\"|4:\"auto\"|crop:\"\"|frame:\"none\"|ori-height:\"447\"|ori-width:\"612\""],[20,"\n","24:\"ns7T\""],[20,"GET /_search"],[20,"\n","24:\"ySC0\"|36:177"],[20,"{"],[20,"\n","24:\"VBt5\"|36:177"],[20," \"aggs\" : {"],[20,"\n","24:\"bnXm\"|36:177"],[20," \"tags\" : {"],[20,"\n","24:\"aSGK\"|36:177"],[20," \"terms\" : {"],[20,"\n","24:\"ldj4\"|36:177"],[20," \"field\" : \"tags\","],[20,"\n","24:\"MH4D\"|36:177"],[20," \"missing\": \"N/A\" "],[20,"\n","24:\"rMm7\"|36:177"],[20," }"],[20,"\n","24:\"Os9H\"|36:177"],[20," }"],[20,"\n","24:\"Kk0S\"|36:177"],[20," }"],[20,"\n","24:\"iG6T\"|36:177"],[20,"}"],[20,"\n","24:\"INlp\"|36:177"],[20,{"gallery":"https://assets.smcdn.cn/docs/assets/paste_error_placeholder-b6c71c3140.png"},"29:0|30:0|3:\"auto\"|4:\"auto\"|crop:\"\"|frame:\"none\"|ori-height:\"447\"|ori-width:\"612\""],[20,"\n","24:\"E7dB\""],[20," 结果10:","31:2"],[20,"\n","24:\"KnuF\""],[20,{"gallery":"https://assets.smcdn.cn/docs/assets/paste_error_placeholder-b6c71c3140.png"},"1:\"%23f5f5f5\"|27:\"9\"|29:0|30:0|3:\"auto\"|4:\"auto\"|crop:\"\"|frame:\"none\"|ori-height:\"447\"|ori-width:\"612\""],[20," ","1:\"%23f5f5f5\"|27:\"9\""],[20,"View Code","1:\"%23ffffff\"|27:\"9\""],[20,"\n","24:\"kSZQ\""],[20,"2.  filter Aggregation  对满足过滤查询的文档进行聚合计算","27:\"12\"|31:2"],[20,"\n","24:\"qxGd\"|32:3|linespacing:\"150\""],[20," 在查询命中的文档中选取符合过滤条件的文档进行聚合,先过滤再聚合","31:2"],[20,"\n","24:\"6Bvd\""],[20,"示例1:","31:2"],[20,"\n","24:\"HNuJ\""],[20,"\n","24:\"IFlk\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"xNML\"|36:177"],[20,"{"],[20,"\n","24:\"7I2g\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"yO3L\"|36:177"],[20," \"age_terms\": {"],[20,"\n","24:\"Okvi\"|36:177"],[20," \"filter\": {\"match\":{\"gender\":\"F\"}},"],[20,"\n","24:\"n15j\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"XYvK\"|36:177"],[20," \"avg_age\": {"],[20,"\n","24:\"LoD5\"|36:177"],[20," \"avg\": {"],[20,"\n","24:\"zrjP\"|36:177"],[20," \"field\": \"age\""],[20,"\n","24:\"ejLU\"|36:177"],[20," }"],[20,"\n","24:\"xnIs\"|36:177"],[20," }"],[20,"\n","24:\"kYQc\"|36:177"],[20," }"],[20,"\n","24:\"egvR\"|36:177"],[20," }"],[20,"\n","24:\"Svv9\"|36:177"],[20," }"],[20,"\n","24:\"ma1U\"|36:177"],[20,"}"],[20,"\n","24:\"SoAs\"|36:177"],[20,"\n","24:\"O2rN\""],[20," 结果1:","31:2"],[20,"\n","24:\"sAUP\""],[20,"\n","24:\"6L7K\""],[20,"{"],[20,"\n","24:\"jPRX\"|36:177"],[20," \"took\": 163,"],[20,"\n","24:\"79iU\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"EEHy\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"7GIq\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"a6N9\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"9b1E\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"kE3h\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"I2TW\"|36:177"],[20," },"],[20,"\n","24:\"f0cL\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"SvfJ\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"vSaj\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"GbQ2\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"iKDn\"|36:177"],[20," },"],[20,"\n","24:\"fV67\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"Xs4J\"|36:177"],[20," \"age_terms\": {"],[20,"\n","24:\"bXSG\"|36:177"],[20," \"doc_count\": 493,"],[20,"\n","24:\"kMLr\"|36:177"],[20," \"avg_age\": {"],[20,"\n","24:\"snJA\"|36:177"],[20," \"value\": 30.3184584178499"],[20,"\n","24:\"sggL\"|36:177"],[20," }"],[20,"\n","24:\"BtSP\"|36:177"],[20," }"],[20,"\n","24:\"JIcn\"|36:177"],[20," }"],[20,"\n","24:\"vU0a\"|36:177"],[20,"}"],[20,"\n","24:\"IOuh\"|36:177"],[20,"\n","24:\"Yyng\""],[20," 3. Filters Aggregation  多个过滤组聚合计算","27:\"12\"|31:2"],[20,"\n","24:\"lmeT\"|32:3|linespacing:\"150\""],[20,"示例1:","31:2"],[20,"\n","24:\"W6NA\""],[20," 准备数据:","31:2"],[20,"\n","24:\"yCTU\""],[20,"\n","24:\"hz7v\""],[20,"PUT /logs/_doc/_bulk?refresh"],[20,"\n","24:\"5kYX\"|36:177"],[20,"{\"index\":{\"_id\":1}}"],[20,"\n","24:\"lVzy\"|36:177"],[20,"{\"body\":\"warning: page could not be rendered\"}"],[20,"\n","24:\"ZLPL\"|36:177"],[20,"{\"index\":{\"_id\":2}}"],[20,"\n","24:\"SXJN\"|36:177"],[20,"{\"body\":\"authentication error\"}"],[20,"\n","24:\"F7Ot\"|36:177"],[20,"{\"index\":{\"_id\":3}}"],[20,"\n","24:\"d4gQ\"|36:177"],[20,"{\"body\":\"warning: connection timed out\"}"],[20,"\n","24:\"T42p\"|36:177"],[20,"\n","24:\"drJh\""],[20,"获取组合过滤后聚合的结果:","31:2"],[20,"\n","24:\"Qmc2\""],[20,"\n","24:\"62qr\""],[20,"GET logs/_search"],[20,"\n","24:\"jTnA\"|36:177"],[20,"{"],[20,"\n","24:\"pvCe\"|36:177"],[20," \"size\": 0,"],[20,"\n","24:\"Du8M\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"Zh4b\"|36:177"],[20," \"messages\": {"],[20,"\n","24:\"TKe7\"|36:177"],[20," \"filters\": {"],[20,"\n","24:\"JBPq\"|36:177"],[20," \"filters\": {"],[20,"\n","24:\"9KQF\"|36:177"],[20," \"errors\": {"],[20,"\n","24:\"k8Kv\"|36:177"],[20," \"match\": {"],[20,"\n","24:\"Q9BF\"|36:177"],[20," \"body\": \"error\""],[20,"\n","24:\"QfsY\"|36:177"],[20," }"],[20,"\n","24:\"iT5C\"|36:177"],[20," },"],[20,"\n","24:\"VYpT\"|36:177"],[20," \"warnings\": {"],[20,"\n","24:\"MXGG\"|36:177"],[20," \"match\": {"],[20,"\n","24:\"s0dt\"|36:177"],[20," \"body\": \"warning\""],[20,"\n","24:\"NEJ7\"|36:177"],[20," }"],[20,"\n","24:\"Wpeg\"|36:177"],[20," }"],[20,"\n","24:\"Oi5x\"|36:177"],[20," }"],[20,"\n","24:\"X4Dy\"|36:177"],[20," }"],[20,"\n","24:\"cUWC\"|36:177"],[20," }"],[20,"\n","24:\"5XvM\"|36:177"],[20," }"],[20,"\n","24:\"A89R\"|36:177"],[20,"}"],[20,"\n","24:\"EDO8\"|36:177"],[20,"\n","24:\"Ht0o\""],[20," 上面的结果:","31:2"],[20,"\n","24:\"jS2F\""],[20,"\n","24:\"B9Oi\""],[20,"{"],[20,"\n","24:\"O6d6\"|36:177"],[20," \"took\": 18,"],[20,"\n","24:\"itGc\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"D6AQ\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"AFUT\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"xrKT\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"S1Ho\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"2qdp\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"LoAh\"|36:177"],[20," },"],[20,"\n","24:\"7NYf\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"RWab\"|36:177"],[20," \"total\": 3,"],[20,"\n","24:\"YjmT\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"R2a9\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"x0OC\"|36:177"],[20," },"],[20,"\n","24:\"bmu8\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"5ASz\"|36:177"],[20," \"messages\": {"],[20,"\n","24:\"C2Fs\"|36:177"],[20," \"buckets\": {"],[20,"\n","24:\"Pkmd\"|36:177"],[20," \"errors\": {"],[20,"\n","24:\"F5Jd\"|36:177"],[20," \"doc_count\": 1"],[20,"\n","24:\"ofYs\"|36:177"],[20," },"],[20,"\n","24:\"zJ4T\"|36:177"],[20," \"warnings\": {"],[20,"\n","24:\"fWob\"|36:177"],[20," \"doc_count\": 2"],[20,"\n","24:\"vxgH\"|36:177"],[20," }"],[20,"\n","24:\"xFYq\"|36:177"],[20," }"],[20,"\n","24:\"0Wfj\"|36:177"],[20," }"],[20,"\n","24:\"rYrL\"|36:177"],[20," }"],[20,"\n","24:\"Yuqu\"|36:177"],[20,"}"],[20,"\n","24:\"dnEo\"|36:177"],[20,"\n","24:\"7rNz\""],[20," 示例2:为其他值组指定key","31:2"],[20,"\n","24:\"pw09\""],[20,"\n","24:\"c4wr\""],[20,"GET logs/_search"],[20,"\n","24:\"tXHY\"|36:177"],[20,"{"],[20,"\n","24:\"tibx\"|36:177"],[20," \"size\": 0,"],[20,"\n","24:\"itY0\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"ReF0\"|36:177"],[20," \"messages\": {"],[20,"\n","24:\"23Uh\"|36:177"],[20," \"filters\": {"],[20,"\n","24:\"9kzm\"|36:177"],[20," \"other_bucket_key\": \"other_messages\","],[20,"\n","24:\"9DRY\"|36:177"],[20," \"filters\": {"],[20,"\n","24:\"AdeM\"|36:177"],[20," \"errors\": {"],[20,"\n","24:\"uzqY\"|36:177"],[20," \"match\": {"],[20,"\n","24:\"L4Uq\"|36:177"],[20," \"body\": \"error\""],[20,"\n","24:\"taFg\"|36:177"],[20," }"],[20,"\n","24:\"GAmj\"|36:177"],[20," },"],[20,"\n","24:\"rJJd\"|36:177"],[20," \"warnings\": {"],[20,"\n","24:\"eX6z\"|36:177"],[20," \"match\": {"],[20,"\n","24:\"RNHp\"|36:177"],[20," \"body\": \"warning\""],[20,"\n","24:\"dU3B\"|36:177"],[20," }"],[20,"\n","24:\"A7Vs\"|36:177"],[20," }"],[20,"\n","24:\"8lh9\"|36:177"],[20," }"],[20,"\n","24:\"Xs11\"|36:177"],[20," }"],[20,"\n","24:\"oL2H\"|36:177"],[20," }"],[20,"\n","24:\"NW9k\"|36:177"],[20," }"],[20,"\n","24:\"wnOq\"|36:177"],[20,"}"],[20,"\n","24:\"Jq6L\"|36:177"],[20,"\n","24:\"q5Jc\""],[20," 结果2:","31:2"],[20,"\n","24:\"dOdn\""],[20,"\n","24:\"GfXT\""],[20,"{"],[20,"\n","24:\"wNuy\"|36:177"],[20," \"took\": 5,"],[20,"\n","24:\"rT7j\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"Axbc\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"HBcS\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"Cae3\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"VHwG\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"ya8E\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"sPrT\"|36:177"],[20," },"],[20,"\n","24:\"o66z\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"aX3I\"|36:177"],[20," \"total\": 3,"],[20,"\n","24:\"Zd7Z\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"qK2E\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"vhEu\"|36:177"],[20," },"],[20,"\n","24:\"lvs5\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"AhJZ\"|36:177"],[20," \"messages\": {"],[20,"\n","24:\"dDGf\"|36:177"],[20," \"buckets\": {"],[20,"\n","24:\"7iiQ\"|36:177"],[20," \"errors\": {"],[20,"\n","24:\"olbx\"|36:177"],[20," \"doc_count\": 1"],[20,"\n","24:\"jKRO\"|36:177"],[20," },"],[20,"\n","24:\"VUFm\"|36:177"],[20," \"warnings\": {"],[20,"\n","24:\"X54B\"|36:177"],[20," \"doc_count\": 2"],[20,"\n","24:\"Xw6d\"|36:177"],[20," },"],[20,"\n","24:\"6X3k\"|36:177"],[20," \"other_messages\": {"],[20,"\n","24:\"wWZy\"|36:177"],[20," \"doc_count\": 0"],[20,"\n","24:\"uVm1\"|36:177"],[20," }"],[20,"\n","24:\"8Xy0\"|36:177"],[20," }"],[20,"\n","24:\"uaul\"|36:177"],[20," }"],[20,"\n","24:\"gF2b\"|36:177"],[20," }"],[20,"\n","24:\"SBTf\"|36:177"],[20,"}"],[20,"\n","24:\"NTz1\"|36:177"],[20,"\n","24:\"vFkj\""],[20," 4. Range Aggregation 范围分组聚合","27:\"12\"|31:2"],[20,"\n","24:\"If9j\"|32:3|linespacing:\"150\""],[20," 示例1:","31:2"],[20,"\n","24:\"6WB8\""],[20,"\n","24:\"LnTQ\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"3JyI\"|36:177"],[20,"{"],[20,"\n","24:\"Lxrf\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"wnrb\"|36:177"],[20," \"age_range\": {"],[20,"\n","24:\"t4i6\"|36:177"],[20," \"range\": {"],[20,"\n","24:\"aLHo\"|36:177"],[20," \"field\": \"age\","],[20,"\n","24:\"yoYj\"|36:177"],[20," \"ranges\": ["],[20,"\n","24:\"NJ24\"|36:177"],[20," {"],[20,"\n","24:\"LkMC\"|36:177"],[20," \"to\": 25"],[20,"\n","24:\"f162\"|36:177"],[20," },"],[20,"\n","24:\"ahOI\"|36:177"],[20," {"],[20,"\n","24:\"iRsC\"|36:177"],[20," \"from\": 25,"],[20,"\n","24:\"onpU\"|36:177"],[20," \"to\": 35"],[20,"\n","24:\"we85\"|36:177"],[20," },"],[20,"\n","24:\"gt6a\"|36:177"],[20," {"],[20,"\n","24:\"77lS\"|36:177"],[20," \"from\": 35"],[20,"\n","24:\"YQtG\"|36:177"],[20," }"],[20,"\n","24:\"bozR\"|36:177"],[20," ]"],[20,"\n","24:\"Han4\"|36:177"],[20," },"],[20,"\n","24:\"Bnfq\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"yXzU\"|36:177"],[20," \"bmax\": {"],[20,"\n","24:\"Xx0D\"|36:177"],[20," \"max\": {"],[20,"\n","24:\"xkdf\"|36:177"],[20," \"field\": \"balance\""],[20,"\n","24:\"elH9\"|36:177"],[20," }"],[20,"\n","24:\"RDNw\"|36:177"],[20," }"],[20,"\n","24:\"PzxX\"|36:177"],[20," }"],[20,"\n","24:\"cibP\"|36:177"],[20," }"],[20,"\n","24:\"dh4r\"|36:177"],[20," }"],[20,"\n","24:\"LIZB\"|36:177"],[20,"}"],[20,"\n","24:\"wAbu\"|36:177"],[20,"\n","24:\"g5zK\""],[20," 结果1:","31:2"],[20,"\n","24:\"O7jh\""],[20,"\n","24:\"0RPL\""],[20,"{"],[20,"\n","24:\"drSE\"|36:177"],[20," \"took\": 7,"],[20,"\n","24:\"vYVL\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"qDLA\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"fU5M\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"0sYw\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"UEEz\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"tXVM\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"xcOg\"|36:177"],[20," },"],[20,"\n","24:\"pxqi\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"7oDH\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"x90C\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"9NUj\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"qpwb\"|36:177"],[20," },"],[20,"\n","24:\"ZAtc\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"E7KL\"|36:177"],[20," \"age_range\": {"],[20,"\n","24:\"HbLZ\"|36:177"],[20," \"buckets\": ["],[20,"\n","24:\"x9HA\"|36:177"],[20," {"],[20,"\n","24:\"D0MD\"|36:177"],[20," \"key\": \"*-25.0\","],[20,"\n","24:\"QHu6\"|36:177"],[20," \"to\": 25,"],[20,"\n","24:\"Qdp1\"|36:177"],[20," \"doc_count\": 225,"],[20,"\n","24:\"0kgP\"|36:177"],[20," \"bmax\": {"],[20,"\n","24:\"ClQJ\"|36:177"],[20," \"value\": 49587"],[20,"\n","24:\"jeEI\"|36:177"],[20," }"],[20,"\n","24:\"WKA1\"|36:177"],[20," },"],[20,"\n","24:\"SJ3x\"|36:177"],[20," {"],[20,"\n","24:\"qJt6\"|36:177"],[20," \"key\": \"25.0-35.0\","],[20,"\n","24:\"Hl3A\"|36:177"],[20," \"from\": 25,"],[20,"\n","24:\"sAMj\"|36:177"],[20," \"to\": 35,"],[20,"\n","24:\"p3Ic\"|36:177"],[20," \"doc_count\": 485,"],[20,"\n","24:\"2Sgd\"|36:177"],[20," \"bmax\": {"],[20,"\n","24:\"Z1HX\"|36:177"],[20," \"value\": 49795"],[20,"\n","24:\"frwT\"|36:177"],[20," }"],[20,"\n","24:\"Ov1M\"|36:177"],[20," },"],[20,"\n","24:\"mXBK\"|36:177"],[20," {"],[20,"\n","24:\"Tii2\"|36:177"],[20," \"key\": \"35.0-*\","],[20,"\n","24:\"rHg1\"|36:177"],[20," \"from\": 35,"],[20,"\n","24:\"yn96\"|36:177"],[20," \"doc_count\": 290,"],[20,"\n","24:\"Ciit\"|36:177"],[20," \"bmax\": {"],[20,"\n","24:\"OHnZ\"|36:177"],[20," \"value\": 49989"],[20,"\n","24:\"Wmhk\"|36:177"],[20," }"],[20,"\n","24:\"rfLu\"|36:177"],[20," }"],[20,"\n","24:\"9tzw\"|36:177"],[20," ]"],[20,"\n","24:\"W7VT\"|36:177"],[20," }"],[20,"\n","24:\"FpUA\"|36:177"],[20," }"],[20,"\n","24:\"oEaI\"|36:177"],[20,"}"],[20,"\n","24:\"WDl5\"|36:177"],[20,"\n","24:\"cMjE\""],[20,"示例2:为组指定key","31:2"],[20,"\n","24:\"NJrb\""],[20,"\n","24:\"MeNX\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"r7nT\"|36:177"],[20,"{"],[20,"\n","24:\"SAyl\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"pXma\"|36:177"],[20," \"age_range\": {"],[20,"\n","24:\"UmgN\"|36:177"],[20," \"range\": {"],[20,"\n","24:\"Jguz\"|36:177"],[20," \"field\": \"age\","],[20,"\n","24:\"fwAW\"|36:177"],[20," \"keyed\": true,"],[20,"\n","24:\"RLep\"|36:177"],[20," \"ranges\": ["],[20,"\n","24:\"gbGq\"|36:177"],[20," {"],[20,"\n","24:\"Fbrk\"|36:177"],[20," \"to\": 25,"],[20,"\n","24:\"8Vnn\"|36:177"],[20," \"key\": \"Ld\""],[20,"\n","24:\"deM9\"|36:177"],[20," },"],[20,"\n","24:\"puIW\"|36:177"],[20," {"],[20,"\n","24:\"7Bb3\"|36:177"],[20," \"from\": 25,"],[20,"\n","24:\"n7VL\"|36:177"],[20," \"to\": 35,"],[20,"\n","24:\"jZ2w\"|36:177"],[20," \"key\": \"Md\""],[20,"\n","24:\"MS1G\"|36:177"],[20," },"],[20,"\n","24:\"sEgU\"|36:177"],[20," {"],[20,"\n","24:\"jQLH\"|36:177"],[20," \"from\": 35,"],[20,"\n","24:\"c0Ax\"|36:177"],[20," \"key\": \"Od\""],[20,"\n","24:\"DTLY\"|36:177"],[20," }"],[20,"\n","24:\"sfI2\"|36:177"],[20," ]"],[20,"\n","24:\"IV2f\"|36:177"],[20," }"],[20,"\n","24:\"ZVkr\"|36:177"],[20," }"],[20,"\n","24:\"tF6r\"|36:177"],[20," }"],[20,"\n","24:\"vLO6\"|36:177"],[20,"}"],[20,"\n","24:\"ciea\"|36:177"],[20,"\n","24:\"IOfB\""],[20,"结果2:","31:2"],[20,"\n","24:\"omxH\""],[20,"\n","24:\"SsXo\""],[20,"{"],[20,"\n","24:\"Cdd7\"|36:177"],[20," \"took\": 2,"],[20,"\n","24:\"rVwy\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"Hfa4\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"WdaX\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"hj4K\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"iDKm\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"NJVX\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"kvK9\"|36:177"],[20," },"],[20,"\n","24:\"T3Hu\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"xXGJ\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"o067\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"DP7m\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"IRZx\"|36:177"],[20," },"],[20,"\n","24:\"0RyD\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"dWop\"|36:177"],[20," \"age_range\": {"],[20,"\n","24:\"aTZ3\"|36:177"],[20," \"buckets\": {"],[20,"\n","24:\"hWHf\"|36:177"],[20," \"Ld\": {"],[20,"\n","24:\"81at\"|36:177"],[20," \"to\": 25,"],[20,"\n","24:\"31IT\"|36:177"],[20," \"doc_count\": 225"],[20,"\n","24:\"z7N4\"|36:177"],[20," },"],[20,"\n","24:\"gPgb\"|36:177"],[20," \"Md\": {"],[20,"\n","24:\"sqpg\"|36:177"],[20," \"from\": 25,"],[20,"\n","24:\"EbK5\"|36:177"],[20," \"to\": 35,"],[20,"\n","24:\"mdJ1\"|36:177"],[20," \"doc_count\": 485"],[20,"\n","24:\"oDm9\"|36:177"],[20," },"],[20,"\n","24:\"Q4Xg\"|36:177"],[20," \"Od\": {"],[20,"\n","24:\"cQqq\"|36:177"],[20," \"from\": 35,"],[20,"\n","24:\"NOg8\"|36:177"],[20," \"doc_count\": 290"],[20,"\n","24:\"biDh\"|36:177"],[20," }"],[20,"\n","24:\"Jwcw\"|36:177"],[20," }"],[20,"\n","24:\"kmcP\"|36:177"],[20," }"],[20,"\n","24:\"dA2Z\"|36:177"],[20," }"],[20,"\n","24:\"yYdk\"|36:177"],[20,"}"],[20,"\n","24:\"fwpn\"|36:177"],[20,"\n","24:\"HQFp\""],[20,"5. Date Range Aggregation  时间范围分组聚合","27:\"12\"|31:2"],[20,"\n","24:\"pHTo\"|32:3|linespacing:\"150\""],[20,"示例1:","31:2"],[20,"\n","24:\"Py0D\""],[20,"from 时间戳 - to 时间戳 的doc文档数","31:2"],[20,"\n","24:\"23pY\""],[20,"GET hot_sentence/_search?size=0"],[20,"\n","24:\"4BpN\"|36:177"],[20,"{"],[20,"\n","24:\"E91V\"|36:177"],[20,"  \"aggs\": {"],[20,"\n","24:\"u5ov\"|36:177"],[20,"    \"create_time_range\": {"],[20,"\n","24:\"ra5W\"|36:177"],[20,"      \"date_range\": {"],[20,"\n","24:\"cjST\"|36:177"],[20,"        \"field\": \"create_time\","],[20,"\n","24:\"wum2\"|36:177"],[20,"        \"ranges\": ["],[20,"\n","24:\"RqMc\"|36:177"],[20,"          {"],[20,"\n","24:\"l8jl\"|36:177"],[20,"            \"to\": 1606892400,"],[20,"\n","24:\"zFEX\"|36:177"],[20,"            \"from\": 0"],[20,"\n","24:\"VSqv\"|36:177"],[20,"          },"],[20,"\n","24:\"aiRg\"|36:177"],[20,"          {"],[20,"\n","24:\"0roy\"|36:177"],[20,"            \"from\": 1606892400,"],[20,"\n","24:\"JgDs\"|36:177"],[20,"            \"to\": 1606892401"],[20,"\n","24:\"Pso5\"|36:177"],[20,"          }"],[20,"\n","24:\"elA5\"|36:177"],[20,"        ]"],[20,"\n","24:\"jCCE\"|36:177"],[20,"      }"],[20,"\n","24:\"2c5J\"|36:177"],[20,"    }"],[20,"\n","24:\"tdAb\"|36:177"],[20,"  }"],[20,"\n","24:\"YQMH\"|36:177"],[20,"}"],[20,"\n","24:\"rROc\"|36:177"],[20,"\n","24:\"pLfo\"|36:177"],[20,"\n","24:\"xxNy\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"Gzcr\"|36:177"],[20,"{"],[20,"\n","24:\"RW6U\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"KsCt\"|36:177"],[20," \"range\": {"],[20,"\n","24:\"IHWc\"|36:177"],[20," \"date_range\": {"],[20,"\n","24:\"Ajwa\"|36:177"],[20," \"field\": \"date\","],[20,"\n","24:\"Kjrh\"|36:177"],[20," \"format\": \"MM-yyy\","],[20,"\n","24:\"dVCY\"|36:177"],[20," \"ranges\": ["],[20,"\n","24:\"dgz9\"|36:177"],[20," {"],[20,"\n","24:\"VnL9\"|36:177"],[20," \"to\": \"now-1d/d\""],[20,"\n","24:\"cRVe\"|36:177"],[20," },"],[20,"\n","24:\"WBET\"|36:177"],[20," {"],[20,"\n","24:\"9Rjp\"|36:177"],[20," \"from\": \"now-1d/d\""],[20,"\n","24:\"86i3\"|36:177"],[20," }"],[20,"\n","24:\"O1Wd\"|36:177"],[20," ]"],[20,"\n","24:\"aTLw\"|36:177"],[20," }"],[20,"\n","24:\"2AoR\"|36:177"],[20," }"],[20,"\n","24:\"OZKE\"|36:177"],[20," }"],[20,"\n","24:\"MHBT\"|36:177"],[20,"}"],[20,"\n","24:\"7TbP\"|36:177"],[20,"\n","24:\"TT64\""],[20,"结果1:","31:2"],[20,"\n","24:\"ZcBx\""],[20,"\n","24:\"Aswi\""],[20,"{"],[20,"\n","24:\"JeSf\"|36:177"],[20," \"took\": 115,"],[20,"\n","24:\"dx8w\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"HEB0\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"5Xql\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"AM1J\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"PkP7\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"2u2a\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"wgBe\"|36:177"],[20," },"],[20,"\n","24:\"8Lyh\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"8f8J\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"68lQ\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"PD85\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"cfT1\"|36:177"],[20," },"],[20,"\n","24:\"lz72\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"YM1N\"|36:177"],[20," \"range\": {"],[20,"\n","24:\"F5Kw\"|36:177"],[20," \"buckets\": ["],[20,"\n","24:\"v0DE\"|36:177"],[20," {"],[20,"\n","24:\"Eryx\"|36:177"],[20," \"key\": \"*-2017-08-01T00:00:00.000Z\","],[20,"\n","24:\"4eZS\"|36:177"],[20," \"to\": 1501545600000,"],[20,"\n","24:\"AbYi\"|36:177"],[20," \"to_as_string\": \"2017-08-01T00:00:00.000Z\","],[20,"\n","24:\"2jCJ\"|36:177"],[20," \"doc_count\": 0"],[20,"\n","24:\"qvPn\"|36:177"],[20," },"],[20,"\n","24:\"rRuj\"|36:177"],[20," {"],[20,"\n","24:\"zcCa\"|36:177"],[20," \"key\": \"2017-08-01T00:00:00.000Z-*\","],[20,"\n","24:\"qNvQ\"|36:177"],[20," \"from\": 1501545600000,"],[20,"\n","24:\"w1Y6\"|36:177"],[20," \"from_as_string\": \"2017-08-01T00:00:00.000Z\","],[20,"\n","24:\"mxbD\"|36:177"],[20," \"doc_count\": 0"],[20,"\n","24:\"U4zR\"|36:177"],[20," }"],[20,"\n","24:\"6bG5\"|36:177"],[20," ]"],[20,"\n","24:\"oQnM\"|36:177"],[20," }"],[20,"\n","24:\"OF32\"|36:177"],[20," }"],[20,"\n","24:\"xk4n\"|36:177"],[20,"}"],[20,"\n","24:\"M7XR\"|36:177"],[20,"6. Date Histogram Aggregation  时间直方图(柱状)聚合","27:\"12\"|31:2"],[20,"\n","24:\"5pEh\"|32:3|linespacing:\"150\""],[20,"就是按天、月、年等进行聚合统计。可按 year (1y), quarter (1q), month (1M), week (1w), day (1d), hour (1h), minute (1m), second (1s) 间隔聚合或指定的时间间隔聚合。","31:2"],[20,"\n","24:\"ndh5\""],[20,"示例1:","31:2"],[20,"\n","24:\"0XrP\""],[20,"calendar_interval","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20," 和","1:\"%23fbfbfb\"|27:\"12\"|31:2"],[20,"fixed_interval","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,"\n","24:\"v8v6\""],[20,"\n","24:\"V3HU\""],[20,"calendar_interval","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20," "],[20,"\n","24:\"gCU8\""],[20,"minute","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,", ","31:2"],[20,"1m","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,"\n","24:\"nOLZ\""],[20,"All minutes begin at 00 seconds. One minute is the interval between 00 seconds of the first minute and 00 seconds of the following minute in the specified time zone, compensating for any intervening leap seconds, so that the number of minutes and seconds past the hour is the same at the start and end.","31:2"],[20,"\n","24:\"M5fF\""],[20,"hour","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,", ","31:2"],[20,"1h","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,"\n","24:\"bO73\""],[20,"All hours begin at 00 minutes and 00 seconds. One hour (1h) is the interval between 00:00 minutes of the first hour and 00:00 minutes of the following hour in the specified time zone, compensating for any intervening leap seconds, so that the number of minutes and seconds past the hour is the same at the start and end.","31:2"],[20,"\n","24:\"JTGr\""],[20,"day","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,", ","31:2"],[20,"1d","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,"\n","24:\"acS7\""],[20,"All days begin at the earliest possible time, which is usually 00:00:00 (midnight). One day (1d) is the interval between the start of the day and the start of of the following day in the specified time zone, compensating for any intervening time changes.","31:2"],[20,"\n","24:\"k0WT\""],[20,"week","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,", ","31:2"],[20,"1w","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,"\n","24:\"iJ0k\""],[20,"One week is the interval between the start day_of_week:hour:minute:second and the same day of the week and time of the following week in the specified time zone.","31:2"],[20,"\n","24:\"fNxW\""],[20,"month","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,", ","31:2"],[20,"1M","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,"\n","24:\"RWgt\""],[20,"One month is the interval between the start day of the month and time of day and the same day of the month and time of the following month in the specified time zone, so that the day of the month and time of day are the same at the start and end.","31:2"],[20,"\n","24:\"axRp\""],[20,"quarter","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,", ","31:2"],[20,"1q","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,"\n","24:\"GAg7\""],[20,"One quarter is the interval between the start day of the month and time of day and the same day of the month and time of day three months later, so that the day of the month and time of day are the same at the start and end.","31:2"],[20,"\n","24:\"U4m5\""],[20,"year","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,", ","31:2"],[20,"1y","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,"\n","24:\"OyBI\""],[20,"One year is the interval between the start day of the month and time of day and the same day of the month and time of day the following year in the specified time zone, so that the date and time are the same at the start and end.","31:2"],[20,"\n","24:\"vRum\""],[20," "],[20,"\n","24:\"0R8U\""],[20,"fixed_interval","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20," "],[20,"\n","24:\"R4Tu\""],[20," "],[20,"milliseconds (","31:2|8:1"],[20,"ms","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,")","31:2"],[20,"\n","24:\"XXbX\""],[20,"A single millisecond. This is a very, very small interval.","31:2"],[20,"\n","24:\"LBbr\""],[20,"seconds (","31:2|8:1"],[20,"s","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,")","31:2"],[20,"\n","24:\"BDkF\""],[20,"Defined as 1000 milliseconds each.","31:2"],[20,"\n","24:\"rwIU\""],[20,"minutes (","31:2|8:1"],[20,"m","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,")","31:2"],[20,"\n","24:\"KvAg\""],[20,"Defined as 60 seconds each (60,000 milliseconds). All minutes begin at 00 seconds.","31:2"],[20,"\n","24:\"afLJ\""],[20,"hours (","31:2|8:1"],[20,"h","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,")","31:2"],[20,"\n","24:\"cmdw\""],[20,"Defined as 60 minutes each (3,600,000 milliseconds). All hours begin at 00 minutes and 00 seconds.","31:2"],[20,"\n","24:\"B5Bb\""],[20,"days (","31:2|8:1"],[20,"d","0:\"%23555555\"|1:\"%23f8f8f8\"|27:\"12\"|31:2|code:true"],[20,")","31:2"],[20,"\n","24:\"MFVo\""],[20,"Defined as 24 hours (86,400,000 milliseconds). All days begin at the earliest possible time, which is usually 00:00:00 (midnight).","31:2"],[20,"\n","24:\"gCOw\""],[20," "],[20,"\n","24:\"Nq7v\""],[20,"\n","24:\"oqXS\""],[20,"GET hot_sentence/_search?size=0"],[20,"\n","24:\"2jRM\"|36:177"],[20,"{"],[20,"\n","24:\"F9Zt\"|36:177"],[20,"  \"aggs\": {"],[20,"\n","24:\"Ml5J\"|36:177"],[20,"    \"create_time_dh\": {"],[20,"\n","24:\"i09P\"|36:177"],[20,"      \"date_histogram\": {"],[20,"\n","24:\"tQ83\"|36:177"],[20,"        \"field\": \"create_time\","],[20,"\n","24:\"DMOB\"|36:177"],[20,"        \"fixed_interval\": \"30s\""],[20,"\n","24:\"bIpB\"|36:177"],[20,"      }"],[20,"\n","24:\"7MSM\"|36:177"],[20,"    }"],[20,"\n","24:\"3sRV\"|36:177"],[20,"  }"],[20,"\n","24:\"ptU1\"|36:177"],[20,"}"],[20,"\n","24:\"R7jf\"|36:177"],[20,"\n","24:\"ThMw\"|36:177"],[20,"GET hot_sentence/_search?size=0"],[20,"\n","24:\"P9P1\"|36:177"],[20,"{"],[20,"\n","24:\"a0ba\"|36:177"],[20,"  \"aggs\": {"],[20,"\n","24:\"pgQ3\"|36:177"],[20,"    \"create_time_dh\": {"],[20,"\n","24:\"35F2\"|36:177"],[20,"      \"date_histogram\": {"],[20,"\n","24:\"DdVJ\"|36:177"],[20,"        \"field\": \"create_time\","],[20,"\n","24:\"XMCt\"|36:177"],[20,"        \"calendar_interval\": \"1d\""],[20,"\n","24:\"iv1l\"|36:177"],[20,"      }"],[20,"\n","24:\"D1Nj\"|36:177"],[20,"    }"],[20,"\n","24:\"lr1i\"|36:177"],[20,"  }"],[20,"\n","24:\"APoO\"|36:177"],[20,"}"],[20,"\n","24:\"hhu9\"|36:177"],[20,"\n","24:\"q49Q\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"w7B4\"|36:177"],[20,"{"],[20,"\n","24:\"OYAb\"|36:177"],[20," \"aggs\": {"],[20,"\n","24:\"LO22\"|36:177"],[20," \"sales_over_time\": {"],[20,"\n","24:\"N5SZ\"|36:177"],[20," \"date_histogram\": {"],[20,"\n","24:\"xZXU\"|36:177"],[20," \"field\": \"date\","],[20,"\n","24:\"8YaI\"|36:177"],[20," \"interval\": \"month\""],[20,"\n","24:\"kopT\"|36:177"],[20," }"],[20,"\n","24:\"lrHy\"|36:177"],[20," }"],[20,"\n","24:\"niw2\"|36:177"],[20," }"],[20,"\n","24:\"DS87\"|36:177"],[20,"}"],[20,"\n","24:\"39Hp\"|36:177"],[20,"\n","24:\"LI8p\""],[20,"结果1:","31:2"],[20,"\n","24:\"avs2\""],[20,"\n","24:\"7UYz\""],[20,"{"],[20,"\n","24:\"t8ON\"|36:177"],[20," \"took\": 9,"],[20,"\n","24:\"uvpr\"|36:177"],[20," \"timed_out\": false,"],[20,"\n","24:\"HnKo\"|36:177"],[20," \"_shards\": {"],[20,"\n","24:\"qNzk\"|36:177"],[20," \"total\": 5,"],[20,"\n","24:\"Cvhh\"|36:177"],[20," \"successful\": 5,"],[20,"\n","24:\"aM7N\"|36:177"],[20," \"skipped\": 0,"],[20,"\n","24:\"F5bS\"|36:177"],[20," \"failed\": 0"],[20,"\n","24:\"z3Fq\"|36:177"],[20," },"],[20,"\n","24:\"Ib7y\"|36:177"],[20," \"hits\": {"],[20,"\n","24:\"3OEQ\"|36:177"],[20," \"total\": 1000,"],[20,"\n","24:\"sKWQ\"|36:177"],[20," \"max_score\": 0,"],[20,"\n","24:\"Y62n\"|36:177"],[20," \"hits\": []"],[20,"\n","24:\"113V\"|36:177"],[20," },"],[20,"\n","24:\"bnAW\"|36:177"],[20," \"aggregations\": {"],[20,"\n","24:\"6KXT\"|36:177"],[20," \"sales_over_time\": {"],[20,"\n","24:\"tBe1\"|36:177"],[20," \"buckets\": []"],[20,"\n","24:\"h9ij\"|36:177"],[20," }"],[20,"\n","24:\"4VLk\"|36:177"],[20," }"],[20,"\n","24:\"AT5a\"|36:177"],[20,"}"],[20,"\n","24:\"oGZa\"|36:177"],[20,"\n","24:\"Pmsg\""],[20,"7. Missing Aggregation  缺失值的桶聚合","27:\"12\"|31:2"],[20,"\n","24:\"xKDx\"|32:3|linespacing:\"150\""],[20,"\n","24:\"m8wk\""],[20,"POST /bank/_search?size=0"],[20,"\n","24:\"NZdH\"|36:177"],[20,"{"],[20,"\n","24:\"w2uo\"|36:177"],[20," \"aggs\" : {"],[20,"\n","24:\"S0L4\"|36:177"],[20," \"account_without_a_age\" : {"],[20,"\n","24:\"njqK\"|36:177"],[20," \"missing\" : { \"field\" : \"age\" }"],[20,"\n","24:\"amPn\"|36:177"],[20," }"],[20,"\n","24:\"8IXn\"|36:177"],[20," }"],[20,"\n","24:\"Fk5q\"|36:177"],[20,"}"],[20,"\n","24:\"mbbq\"|36:177"],[20,"\n","24:\"ZDco\""],[20,"8. Geo Distance Aggregation  地理距离分区聚合","27:\"12\"|31:2"],[20,"\n","24:\"sSjO\"|32:3|linespacing:\"150\""],[20,"参考官网链接:","31:2"],[20,"\n","24:\"YfGi\""],[20,"https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-geodistance-aggregation.html","16:\"https%3A%2F%2Fwww.elastic.co%2Fguide%2Fen%2Felasticsearch%2Freference%2Fcurrent%2Fsearch-aggregations-bucket-geodistance-aggregation.html\"|31:2"],[20,"\n","24:\"init\""],[20,"\n","24:\"vpIX\""],[20,"聚合","27:\"22\"|31:2|8:1"],[20,"\n","24:\"Cjbe\"|32:1|linespacing:\"115\""],[20,"聚合分析主要分为以下四类","27:\"12\""],[20,"\n","24:\"2mBs\"|linespacing:\"150\""],[20,"Bucket,分桶类型,类似于group by,按照一定的规则将文档分配到不同的桶中,以达到分类分析的目的","27:\"12\""],[20,"\n","24:\"6Wzn\"|linespacing:\"150\""],[20,"Terms根据term分桶,如果是text类型,则按照分词后的结果分桶","27:\"12\""],[20,"\n","24:\"OxuN\"|linespacing:\"150\""],[20,"range(指定数值范围来设置分桶)","27:\"12\""],[20,"\n","24:\"QNwj\"|linespacing:\"150\""],[20,"data range(指定日期的范围)","27:\"12\""],[20,"\n","24:\"sCvJ\"|linespacing:\"150\""],[20,"histogram(以固定间隔的策略分割)","27:\"12\""],[20,"\n","24:\"tGWN\"|linespacing:\"150\""],[20,"date histogram(针对日期)","27:\"12\""],[20,"\n","24:\"Zaj0\"|linespacing:\"150\""],[20,"Metric,指标分析类型,如最大值、最小值、平均值等等","27:\"12\""],[20,"\n","24:\"irt6\"|linespacing:\"150\""],[20,"单值分析 min、max、avg、sum、cardinality(distinct count)","27:\"12\""],[20,"\n","24:\"Xqcp\"|linespacing:\"150\""],[20,"多值分析 stats,extended stats percentile(百分位数) percentile rank top hits","27:\"12\""],[20,"\n","24:\"OHne\"|linespacing:\"150\""],[20,"Pipeline,管道分析类型,基于上一级的聚合分析结果","27:\"12\""],[20,"\n","24:\"KNAC\"|linespacing:\"150\""],[20,"Parent结果内嵌到现有的聚合分析结果","27:\"12\""],[20,"\n","24:\"q0NS\"|linespacing:\"150\""],[20,"Sibling结果与现有聚合分析结果同级","27:\"12\""],[20,"\n","24:\"luhR\"|linespacing:\"150\""],[20,"Matrix,矩阵分析类型","27:\"12\""],[20,"\n","24:\"n4Sr\"|linespacing:\"150\""],[20,"语法","27:\"12\""],[20,"\n","24:\"Ehnw\"|linespacing:\"150\""],[20,"aggs->聚合名字->聚合类型->聚合内容","27:\"12\""],[20,"\n","24:\"lJ8A\"|linespacing:\"150\""],[20,"下面看一下聚合,聚合这里要注意一个点,如果对text类型的字段进行聚合时,要先把该字段设为fielddata:true,具体","27:\"12\""],[20,"请看","0:\"%236795b5\"|16:\"https%3A%2F%2Fwww.elastic.co%2Fguide%2Fen%2Felasticsearch%2Freference%2Fcurrent%2Ffielddata.html\"|27:\"12\""]]">

    https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations.html

    GET hot_sentence/_search?size=0
    {
    "aggs": {
    "create_time_dh": {
    "date_histogram": {
    "order": {
    "avg_age": "asc"
    },
    "field": "create_time",
    "fixed_interval": "30s"
    },
    "aggs": {
    "avg_age": {
    "avg": {
    "field": "hot_level"
    }
    }
    }
    }
    }
    }

    elasticsearch系列六:聚合分析(聚合分析简介、指标聚合、桶聚合)

    一、聚合分析简介

     1. ES聚合分析是什么?

    聚合分析是数据库中重要的功能特性,完成对一个查询的数据集中数据的聚合计算,如:找出某字段(或计算表达式的结果)的最大值、最小值,计算和、平均值等。ES作为搜索引擎兼数据库,同样提供了强大的聚合分析能力。

    对一个数据集求最大、最小、和、平均值等指标的聚合,在ES中称为指标聚合   metric

    而关系型数据库中除了有聚合函数外,还可以对查询出的数据进行分组group by,再在组上进行指标聚合。在 ES 中group by 称为分桶桶聚合 bucketing

    ES中还提供了矩阵聚合(matrix)、管道聚合(pipleline),但还在完善中。 

     2. ES聚合分析查询的写法

     在查询请求体中以aggregations节点按如下语法定义聚合分析:

    "aggregations" : {
    "" : {
    "" : {
    }
    [,"meta" : { [] } ]?
    [,"aggregations" : { []+ } ]?
    }
    [,"" : { ... } ]*
    }

     说明:

    aggregations 也可简写为 aggs

     3. 聚合分析的值来源

    聚合计算的值可以取字段的值,也可是脚本计算的结果

    二、指标聚合

    1. max min sum avg

    示例1:查询所有客户中余额的最大值

    POST /bank/_search?
    {
    "size": 0,
    "aggs": {
    "masssbalance": {
    "max": {
    "field": "balance"
    }
    }
    }
    }

     结果1:

    {
    "took": 2080,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "masssbalance": {
    "value": 49989
    }
    }
    }

    示例2:查询年龄为24岁的客户中的余额最大值

    POST /bank/_search?
    {
    "size": 2,
    "query": {
    "match": {
    "age": 24
    }
    },
    "sort": [
    {
    "balance": {
    "order": "desc"
    }
    }
    ],
    "aggs": {
    "max_balance": {
    "max": {
    "field": "balance"
    }
    }
    }
    }

     结果2:

    {
    "took": 5,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 42,
    "max_score": null,
    "hits": [
    {
    "_index": "bank",
    "_type": "_doc",
    "_id": "697",
    "_score": null,
    "_source": {
    "account_number": 697,
    "balance": 48745,
    "firstname": "Mallory",
    "lastname": "Emerson",
    "age": 24,
    "gender": "F",
    "address": "318 Dunne Court",
    "employer": "Exoplode",
    "email": "malloryemerson@exoplode.com",
    "city": "Montura",
    "state": "LA"
    },
    "sort": [
    48745
    ]
    },
    {
    "_index": "bank",
    "_type": "_doc",
    "_id": "917",
    "_score": null,
    "_source": {
    "account_number": 917,
    "balance": 47782,
    "firstname": "Parks",
    "lastname": "Hurst",
    "age": 24,
    "gender": "M",
    "address": "933 Cozine Avenue",
    "employer": "Pyramis",
    "email": "parkshurst@pyramis.com",
    "city": "Lindcove",
    "state": "GA"
    },
    "sort": [
    47782
    ]
    }
    ]
    },
    "aggregations": {
    "max_balance": {
    "value": 48745
    }
    }
    }

     示例3:值来源于脚本,查询所有客户的平均年龄是多少,并对平均年龄加10

    POST /bank/_search?size=0
    {
    "aggs": {
    "avg_age": {
    "avg": {
    "script": {
    "source": "doc.age.value"
    }
    }
    },
    "avg_age10": {
    "avg": {
    "script": {
    "source": "doc.age.value + 10"
    }
    }
    }
    }
    }

     结果3:

    {
    "took": 86,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "avg_age": {
    "value": 30.171
    },
    "avg_age10": {
    "value": 40.171
    }
    }
    }

     示例4:指定field,在脚本中用_value 取字段的值

    POST /bank/_search?size=0
    {
    "aggs": {
    "sum_balance": {
    "sum": {
    "field": "balance",
    "script": {
    "source": "_value * 1.03"
    }
    }
    }
    }
    }

     结果4:

    {
    "took": 165,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "sum_balance": {
    "value": 26486282.11
    }
    }
    }

     示例5:为没有值字段指定值。如未指定,缺失该字段值的文档将被忽略。

    POST /bank/_search?size=0
    {
    "aggs": {
    "avg_age": {
    "avg": {
    "field": "age",
    "missing": 18
    }
    }
    }
    }

     2. 文档计数 count

     示例1:统计银行索引bank下年龄为24的文档数量

    POST /bank/_doc/_count
    {
    "query": {
    "match": {
    "age" : 24
    }
    }
    }

     结果1:

    {
    "count": 42,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    }
    }

     3. Value count 统计某字段有值的文档数

    示例1:

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_count": {
    "value_count": {
    "field": "age"
    }
    }
    }
    }

     结果1:

    {
    "took": 2022,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "age_count": {
    "value": 1000
    }
    }
    }

     4. cardinality  值去重计数

    示例1

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_count": {
    "cardinality": {
    "field": "age"
    }
    },
    "state_count": {
    "cardinality": {
    "field": "state.keyword"
    }
    }
    }
    }

     说明:state的使用它的keyword版

     结果1:

    {
    "took": 2074,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "state_count": {
    "value": 51
    },
    "age_count": {
    "value": 21
    }
    }
    }

     5. stats 统计 count max min avg sum 5个值

     示例1:

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_stats": {
    "stats": {
    "field": "age"
    }
    }
    }
    }

           a478c6f74dbb04b0ba90758c1d6093a5.png      

     结果1:

           a478c6f74dbb04b0ba90758c1d6093a5.png      

    {
    "took": 7,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "age_stats": {
    "count": 1000,
    "min": 20,
    "max": 40,
    "avg": 30.171,
    "sum": 30171
    }
    }
    }

           a478c6f74dbb04b0ba90758c1d6093a5.png      

     6. Extended stats

    高级统计,比stats多4个统计结果:平方和、方差、标准差、平均值加/减两个标准差的区间

     示例1:

           a478c6f74dbb04b0ba90758c1d6093a5.png      

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_stats": {
    "extended_stats": {
    "field": "age"
    }
    }
    }
    }

           a478c6f74dbb04b0ba90758c1d6093a5.png      

     结果1:

           a478c6f74dbb04b0ba90758c1d6093a5.png      

    {
    "took": 7,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "age_stats": {
    "count": 1000,
    "min": 20,
    "max": 40,
    "avg": 30.171,
    "sum": 30171,
    "sum_of_squares": 946393,
    "variance": 36.10375899999996,
    "std_deviation": 6.008640362012022,
    "std_deviation_bounds": {
    "upper": 42.18828072402404,
    "lower": 18.153719275975956
    }
    }
    }
    }

           a478c6f74dbb04b0ba90758c1d6093a5.png      

     7. Percentiles 占比百分位对应的值统计

    对指定字段(脚本)的值按从小到大累计每个值对应的文档数的占比(占所有命中文档数的百分比),返回指定占比比例对应的值。默认返回[ 1, 5, 25, 50, 75, 95, 99 ]分位上的值。如下中间的结果,可以理解为:占比为50%的文档的age值 <= 31,或反过来:age<=31的文档数占总命中文档数的50%

     示例1:

           a478c6f74dbb04b0ba90758c1d6093a5.png      

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_percents": {
    "percentiles": {
    "field": "age"
    }
    }
    }
    }

    结果1:

    {
    "took": 87,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "age_percents": {
    "values": {
    "1.0": 20,
    "5.0": 21,
    "25.0": 25,
    "50.0": 31,
    "75.0": 35.00000000000001,
    "95.0": 39,
    "99.0": 40
    }
    }
    }
    }

     结果说明:

    占比为50%的文档的age值 <= 31,或反过来:age<=31的文档数占总命中文档数的50%

     示例2:指定分位值

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_percents": {
    "percentiles": {
    "field": "age",
    "percents" : [95, 99, 99.9]
    }
    }
    }
    }

     结果2:

    {
    "took": 8,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "age_percents": {
    "values": {
    "95.0": 39,
    "99.0": 40,
    "99.9": 40
    }
    }
    }
    }

     8. Percentiles rank 统计值小于等于指定值的文档占比

     示例1:统计年龄小于25和30的文档的占比,和第7项相反

    POST /bank/_search?size=0
    {
    "aggs": {
    "gge_perc_rank": {
    "percentile_ranks": {
    "field": "age",
    "values": [
    25,
    30
    ]
    }
    }
    }
    }

    结果2:

           a478c6f74dbb04b0ba90758c1d6093a5.png      

    {
    "took": 8,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "gge_perc_rank": {
    "values": {
    "25.0": 26.1,
    "30.0": 49.2
    }
    }
    }
    }

           a478c6f74dbb04b0ba90758c1d6093a5.png      

     结果说明:年龄小于25的文档占比为26.1%,年龄小于30的文档占比为49.2%,

     9. Geo Bounds aggregation 求文档集中的地理位置坐标点的范围

    参考官网链接:

    https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-geobounds-aggregation.html

    10. Geo Centroid aggregation  求地理位置中心点坐标值

    参考官网链接:

    https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-geocentroid-aggregation.html

    三、桶聚合

           a478c6f74dbb04b0ba90758c1d6093a5.png      

    1. Terms Aggregation  根据字段值项分组聚合 

     示例1:

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_terms": {
    "terms": {
    "field": "age"
    }
    }
    }
    }

     结果1:

    {
    "took": 2000,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "age_terms": {
    "doc_count_error_upper_bound": 0,
    "sum_other_doc_count": 463,
    "buckets": [
    {
    "key": 31,
    "doc_count": 61
    },
    {
    "key": 39,
    "doc_count": 60
    },
    {
    "key": 26,
    "doc_count": 59
    },
    {
    "key": 32,
    "doc_count": 52
    },
    {
    "key": 35,
    "doc_count": 52
    },
    {
    "key": 36,
    "doc_count": 52
    },
    {
    "key": 22,
    "doc_count": 51
    },
    {
    "key": 28,
    "doc_count": 51
    },
    {
    "key": 33,
    "doc_count": 50
    },
    {
    "key": 34,
    "doc_count": 49
    }
    ]
    }
    }
    }

     结果说明:

    "doc_count_error_upper_bound": 0:文档计数的最大偏差值

    "sum_other_doc_count": 463:未返回的其他项的文档数

    默认情况下返回按文档计数从高到低的前10个分组:

     "buckets": [
    {
    "key": 31,
    "doc_count": 61
    },
    {
    "key": 39,
    "doc_count": 60
    },
    .............
    ]

     年龄为31的文档有61个,年龄为39的文档有60个

     size 指定返回多少个分组:

    示例2:指定返回20个分组

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_terms": {
    "terms": {
    "field": "age",
    "size": 20
    }
    }
    }
    }

     结果2:

     View Code

     示例3:每个分组上显示偏差值

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_terms": {
    "terms": {
    "field": "age",
    "size": 5,
    "shard_size": 20,
    "show_term_doc_count_error": true
    }
    }
    }
    }

     结果3:

    {
    "took": 8,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "age_terms": {
    "doc_count_error_upper_bound": 25,
    "sum_other_doc_count": 716,
    "buckets": [
    {
    "key": 31,
    "doc_count": 61,
    "doc_count_error_upper_bound": 0
    },
    {
    "key": 39,
    "doc_count": 60,
    "doc_count_error_upper_bound": 0
    },
    {
    "key": 26,
    "doc_count": 59,
    "doc_count_error_upper_bound": 0
    },
    {
    "key": 32,
    "doc_count": 52,
    "doc_count_error_upper_bound": 0
    },
    {
    "key": 36,
    "doc_count": 52,
    "doc_count_error_upper_bound": 0
    }
    ]
    }
    }
    }

     示例4:shard_size 指定每个分片上返回多少个分组

    shard_size 的默认值为:

    索引只有一个分片:= size

    多分片:= size * 1.5 + 10

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_terms": {
    "terms": {
    "field": "age",
    "size": 5,
    "shard_size": 20
    }
    }
    }
    }

     结果4:

    {
    "took": 8,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "age_terms": {
    "doc_count_error_upper_bound": 25,
    "sum_other_doc_count": 716,
    "buckets": [
    {
    "key": 31,
    "doc_count": 61
    },
    {
    "key": 39,
    "doc_count": 60
    },
    {
    "key": 26,
    "doc_count": 59
    },
    {
    "key": 32,
    "doc_count": 52
    },
    {
    "key": 36,
    "doc_count": 52
    }
    ]
    }
    }
    }

     order  指定分组的排序

     示例5:根据文档计数排序

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_terms": {
    "terms": {
    "field": "age",
    "order" : { "_count" : "asc" }
    }
    }
    }
    }

     结果5:

    {
    "took": 3,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "age_terms": {
    "doc_count_error_upper_bound": 0,
    "sum_other_doc_count": 584,
    "buckets": [
    {
    "key": 29,
    "doc_count": 35
    },
    {
    "key": 27,
    "doc_count": 39
    },
    {
    "key": 38,
    "doc_count": 39
    },
    {
    "key": 23,
    "doc_count": 42
    },
    {
    "key": 24,
    "doc_count": 42
    },
    {
    "key": 25,
    "doc_count": 42
    },
    {
    "key": 37,
    "doc_count": 42
    },
    {
    "key": 20,
    "doc_count": 44
    },
    {
    "key": 40,
    "doc_count": 45
    },
    {
    "key": 21,
    "doc_count": 46
    }
    ]
    }
    }
    }

     示例6:根据分组值排序

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_terms": {
    "terms": {
    "field": "age",
    "order" : { "_key" : "asc" }
    }
    }
    }
    }

     结果6:

    {
    "took": 10,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "age_terms": {
    "doc_count_error_upper_bound": 0,
    "sum_other_doc_count": 549,
    "buckets": [
    {
    "key": 20,
    "doc_count": 44
    },
    {
    "key": 21,
    "doc_count": 46
    },
    {
    "key": 22,
    "doc_count": 51
    },
    {
    "key": 23,
    "doc_count": 42
    },
    {
    "key": 24,
    "doc_count": 42
    },
    {
    "key": 25,
    "doc_count": 42
    },
    {
    "key": 26,
    "doc_count": 59
    },
    {
    "key": 27,
    "doc_count": 39
    },
    {
    "key": 28,
    "doc_count": 51
    },
    {
    "key": 29,
    "doc_count": 35
    }
    ]
    }
    }
    }

    示例7:取分组指标值排序

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_terms": {
    "terms": {
    "field": "age",
    "order": {
    "max_balance": "asc"
    }
    },
    "aggs": {
    "max_balance": {
    "max": {
    "field": "balance"
    }
    },
    "min_balance": {
    "min": {
    "field": "balance"
    }
    }
    }
    }
    }
    }

     结果7:

     View Code

     示例8:筛选分组-正则表达式匹配值

    GET /_search
    {
    "aggs" : {
    "tags" : {
    "terms" : {
    "field" : "tags",
    "include" : ".*sport.*",
    "exclude" : "water_.*"
    }
    }
    }
    }

     示例9:筛选分组-指定值列表

    GET /_search
    {
    "aggs" : {
    "JapaneseCars" : {
    "terms" : {
    "field" : "make",
    "include" : ["mazda", "honda"]
    }
    },
    "ActiveCarManufacturers" : {
    "terms" : {
    "field" : "make",
    "exclude" : ["rover", "jensen"]
    }
    }
    }
    }

     示例10:根据脚本计算值分组

    GET /_search
    {
    "aggs" : {
    "genres" : {
    "terms" : {
    "script" : {
    "source": "doc['genre'].value",
    "lang": "painless"
    }
    }
    }
    }
    }

     示例1:缺失值处理

           a478c6f74dbb04b0ba90758c1d6093a5.png      

    GET /_search
    {
    "aggs" : {
    "tags" : {
    "terms" : {
    "field" : "tags",
    "missing": "N/A"
    }
    }
    }
    }

           a478c6f74dbb04b0ba90758c1d6093a5.png      

     结果10:

           a478c6f74dbb04b0ba90758c1d6093a5.png       View Code

    2.  filter Aggregation  对满足过滤查询的文档进行聚合计算

     在查询命中的文档中选取符合过滤条件的文档进行聚合,先过滤再聚合

    示例1:

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_terms": {
    "filter": {"match":{"gender":"F"}},
    "aggs": {
    "avg_age": {
    "avg": {
    "field": "age"
    }
    }
    }
    }
    }
    }

     结果1:

    {
    "took": 163,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "age_terms": {
    "doc_count": 493,
    "avg_age": {
    "value": 30.3184584178499
    }
    }
    }
    }

     3. Filters Aggregation  多个过滤组聚合计算

    示例1:

     准备数据:

    PUT /logs/_doc/_bulk?refresh
    {"index":{"_id":1}}
    {"body":"warning: page could not be rendered"}
    {"index":{"_id":2}}
    {"body":"authentication error"}
    {"index":{"_id":3}}
    {"body":"warning: connection timed out"}

    获取组合过滤后聚合的结果:

    GET logs/_search
    {
    "size": 0,
    "aggs": {
    "messages": {
    "filters": {
    "filters": {
    "errors": {
    "match": {
    "body": "error"
    }
    },
    "warnings": {
    "match": {
    "body": "warning"
    }
    }
    }
    }
    }
    }
    }

     上面的结果:

    {
    "took": 18,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 3,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "messages": {
    "buckets": {
    "errors": {
    "doc_count": 1
    },
    "warnings": {
    "doc_count": 2
    }
    }
    }
    }
    }

     示例2:为其他值组指定key

    GET logs/_search
    {
    "size": 0,
    "aggs": {
    "messages": {
    "filters": {
    "other_bucket_key": "other_messages",
    "filters": {
    "errors": {
    "match": {
    "body": "error"
    }
    },
    "warnings": {
    "match": {
    "body": "warning"
    }
    }
    }
    }
    }
    }
    }

     结果2:

    {
    "took": 5,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 3,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "messages": {
    "buckets": {
    "errors": {
    "doc_count": 1
    },
    "warnings": {
    "doc_count": 2
    },
    "other_messages": {
    "doc_count": 0
    }
    }
    }
    }
    }

     4. Range Aggregation 范围分组聚合

     示例1:

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_range": {
    "range": {
    "field": "age",
    "ranges": [
    {
    "to": 25
    },
    {
    "from": 25,
    "to": 35
    },
    {
    "from": 35
    }
    ]
    },
    "aggs": {
    "bmax": {
    "max": {
    "field": "balance"
    }
    }
    }
    }
    }
    }

     结果1:

    {
    "took": 7,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "age_range": {
    "buckets": [
    {
    "key": "*-25.0",
    "to": 25,
    "doc_count": 225,
    "bmax": {
    "value": 49587
    }
    },
    {
    "key": "25.0-35.0",
    "from": 25,
    "to": 35,
    "doc_count": 485,
    "bmax": {
    "value": 49795
    }
    },
    {
    "key": "35.0-*",
    "from": 35,
    "doc_count": 290,
    "bmax": {
    "value": 49989
    }
    }
    ]
    }
    }
    }

    示例2:为组指定key

    POST /bank/_search?size=0
    {
    "aggs": {
    "age_range": {
    "range": {
    "field": "age",
    "keyed": true,
    "ranges": [
    {
    "to": 25,
    "key": "Ld"
    },
    {
    "from": 25,
    "to": 35,
    "key": "Md"
    },
    {
    "from": 35,
    "key": "Od"
    }
    ]
    }
    }
    }
    }

    结果2:

    {
    "took": 2,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "age_range": {
    "buckets": {
    "Ld": {
    "to": 25,
    "doc_count": 225
    },
    "Md": {
    "from": 25,
    "to": 35,
    "doc_count": 485
    },
    "Od": {
    "from": 35,
    "doc_count": 290
    }
    }
    }
    }
    }

    5. Date Range Aggregation  时间范围分组聚合

    示例1:

    from 时间戳 - to 时间戳 的doc文档数

    GET hot_sentence/_search?size=0
    {
    "aggs": {
    "create_time_range": {
    "date_range": {
    "field": "create_time",
    "ranges": [
    {
    "to": 1606892400,
    "from": 0
    },
    {
    "from": 1606892400,
    "to": 1606892401
    }
    ]
    }
    }
    }
    }
    POST /bank/_search?size=0
    {
    "aggs": {
    "range": {
    "date_range": {
    "field": "date",
    "format": "MM-yyy",
    "ranges": [
    {
    "to": "now-1d/d"
    },
    {
    "from": "now-1d/d"
    }
    ]
    }
    }
    }
    }

    结果1:

    {
    "took": 115,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "range": {
    "buckets": [
    {
    "key": "*-2017-08-01T00:00:00.000Z",
    "to": 1501545600000,
    "to_as_string": "2017-08-01T00:00:00.000Z",
    "doc_count": 0
    },
    {
    "key": "2017-08-01T00:00:00.000Z-*",
    "from": 1501545600000,
    "from_as_string": "2017-08-01T00:00:00.000Z",
    "doc_count": 0
    }
    ]
    }
    }
    }

    6. Date Histogram Aggregation  时间直方图(柱状)聚合

    就是按天、月、年等进行聚合统计。可按 year (1y), quarter (1q), month (1M), week (1w), day (1d), hour (1h), minute (1m), second (1s) 间隔聚合或指定的时间间隔聚合。

    示例1:

    calendar_interval 和fixed_interval

    calendar_interval

    minute1m

    All minutes begin at 00 seconds. One minute is the interval between 00 seconds of the first minute and 00 seconds of the following minute in the specified time zone, compensating for any intervening leap seconds, so that the number of minutes and seconds past the hour is the same at the start and end.

    hour1h

    All hours begin at 00 minutes and 00 seconds. One hour (1h) is the interval between 00:00 minutes of the first hour and 00:00 minutes of the following hour in the specified time zone, compensating for any intervening leap seconds, so that the number of minutes and seconds past the hour is the same at the start and end.

    day1d

    All days begin at the earliest possible time, which is usually 00:00:00 (midnight). One day (1d) is the interval between the start of the day and the start of of the following day in the specified time zone, compensating for any intervening time changes.

    week1w

    One week is the interval between the start day_of_week:hour:minute:second and the same day of the week and time of the following week in the specified time zone.

    month1M

    One month is the interval between the start day of the month and time of day and the same day of the month and time of the following month in the specified time zone, so that the day of the month and time of day are the same at the start and end.

    quarter1q

    One quarter is the interval between the start day of the month and time of day and the same day of the month and time of day three months later, so that the day of the month and time of day are the same at the start and end.

    year1y

    One year is the interval between the start day of the month and time of day and the same day of the month and time of day the following year in the specified time zone, so that the date and time are the same at the start and end.

    fixed_interval

    milliseconds (ms)

    A single millisecond. This is a very, very small interval.

    seconds (s)

    Defined as 1000 milliseconds each.

    minutes (m)

    Defined as 60 seconds each (60,000 milliseconds). All minutes begin at 00 seconds.

    hours (h)

    Defined as 60 minutes each (3,600,000 milliseconds). All hours begin at 00 minutes and 00 seconds.

    days (d)

    Defined as 24 hours (86,400,000 milliseconds). All days begin at the earliest possible time, which is usually 00:00:00 (midnight).

    GET hot_sentence/_search?size=0
    {
    "aggs": {
    "create_time_dh": {
    "date_histogram": {
    "field": "create_time",
    "fixed_interval": "30s"
    }
    }
    }
    }
    GET hot_sentence/_search?size=0
    {
    "aggs": {
    "create_time_dh": {
    "date_histogram": {
    "field": "create_time",
    "calendar_interval": "1d"
    }
    }
    }
    }
    POST /bank/_search?size=0
    {
    "aggs": {
    "sales_over_time": {
    "date_histogram": {
    "field": "date",
    "interval": "month"
    }
    }
    }
    }

    结果1:

    {
    "took": 9,
    "timed_out": false,
    "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
    },
    "hits": {
    "total": 1000,
    "max_score": 0,
    "hits": []
    },
    "aggregations": {
    "sales_over_time": {
    "buckets": []
    }
    }
    }

    7. Missing Aggregation  缺失值的桶聚合

    POST /bank/_search?size=0
    {
    "aggs" : {
    "account_without_a_age" : {
    "missing" : { "field" : "age" }
    }
    }
    }

    8. Geo Distance Aggregation  地理距离分区聚合

    参考官网链接:

    https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-geodistance-aggregation.html

    聚合

    聚合分析主要分为以下四类

    Bucket,分桶类型,类似于group by,按照一定的规则将文档分配到不同的桶中,以达到分类分析的目的

    Terms根据term分桶,如果是text类型,则按照分词后的结果分桶

    range(指定数值范围来设置分桶)

    data range(指定日期的范围)

    histogram(以固定间隔的策略分割)

    date histogram(针对日期)

    Metric,指标分析类型,如最大值、最小值、平均值等等

    单值分析 min、max、avg、sum、cardinality(distinct count)

    多值分析 stats,extended stats percentile(百分位数) percentile rank top hits

    Pipeline,管道分析类型,基于上一级的聚合分析结果

    Parent结果内嵌到现有的聚合分析结果

    Sibling结果与现有聚合分析结果同级

    Matrix,矩阵分析类型

    语法

    aggs->聚合名字->聚合类型->聚合内容

    下面看一下聚合,聚合这里要注意一个点,如果对text类型的字段进行聚合时,要先把该字段设为fielddata:true,具体请看

    yk

    9a364a2e7ed9eca8b1fc66eff97493e6.png

    展开全文
  • 云搜索服务 CSS云搜索服务是一个基于Elasticsearch且完全托管的在线分布式搜索服务,为用户提供结构化、非结构化文本的多条件检索、统计、报表。完全兼容开源Elasticsearch软件原生接口。它可以帮助网站和APP搭建...

    云搜索服务 CSS

    云搜索服务是一个基于Elasticsearch且完全托管的在线分布式搜索服务,为用户提供结构化、非结构化文本的多条件检索、统计、报表。完全兼容开源Elasticsearch软件原生接口。它可以帮助网站和APP搭建搜索框,提升用户寻找资料和视频的体验;还可以搭建日志分析平台,在运维上进行业务日志分析和监控,在运营上进行流量分析等等。

    云搜索服务 CSS

    云搜索服务是一个基于Elasticsearch且完全托管的在线分布式搜索服务,为用户提供结构化、非结构化文本的多条件检索、统计、报表。完全兼容开源Elasticsearch软件原生接口。它可以帮助网站和APP搭建搜索框,提升用户寻找资料和视频的体验;还可以搭建日志分析平台,在运维上进行业务日志分析和监控,在运营上进行流量分析等等。

    合理的设计程序结构,可以优化执行效率。在程序编写过程中要尽量减少shuffle操作,合并窄依赖操作。 操作步骤 以“同行车判断”例子讲解DAG设计的思路。 数据格式:通过收费站时间、车牌号、收费站编号...... 逻辑:以下两种情况下判定这两辆车是同行车: 如果两辆车都通过相同序列的收费站,

    集群列表简介 集群列表显示云搜索服务所有的集群,集群数量较多时,可采用翻页显示,您可以查看任何状态下的集群。 集群列表默认按时间顺序排列,时间最近的集群显示在最前端。在集群列表的表头,您可以单击对应参数的按钮,修改集群的排序。集群列表参数说明如表1所示。 在集群列表右上角,您可以

    查看Windows调测结果 操作场景 Manager应用程序运行完成后,可通过如下方式查看运行结果: 通过IntelliJ IDEA运行结果查看应用程序运行情况,可通过配置文件“conf\log4j.properties”配置日志打印信息。 登录主管理节点查看系统日志“/var/

    10; // Integer | 返回的数据条数

    String order = "desc"; // String | 查询结果排序, 升序和降序两种可选

    try {

    QueryClusterHostsInfoResponse result = apiInstance

    合理的设计程序结构,可以优化执行效率。在程序编写过程中要尽量减少shuffle操作,合并窄依赖操作。 操作步骤 以“同行车判断”例子讲解DAG设计的思路。 数据格式:通过收费站时间、车牌号、收费站编号...... 逻辑:以下两种情况下判定这两辆车是同行车 如果两辆车都通过相同序列的收费站,

    10; // Integer | 返回的数据条数

    String order = "desc"; // String | 查询结果排序, 升序和降序两种可选

    try {

    QueryClustersResponse result = apiInstance.getRes

    20; // Integer | 返回的数据条数

    String order = "desc"; // String | 查询结果排序, 升序和降序两种可选

    try {

    QueryUserQuotasResponse result = apiInstance.getU

    WHERE条件中的参数为API请求参数,参数格式为${参数名} 选择分页方式。 添加排序参数。 在排序参数列表中,设置排序字段是否可选,排序方式和描述。 单击,将入参和排序参数添加为SQL语句的API请求参数。 添加排序参数前,请确保SQL语句正确。 编辑请求参数信息 编写好API查询SQL

    API提供Scala和Java两种语言的开发方式,如表1所示。 表1 Flink DataStream API接口 功能 说明 Scala API 提供Scala语言的API,提供过滤、join、窗口、聚合等数据处理能力。由于Scala语言的简洁易懂,推荐用户使用Scala接口进行程序开发。 Java

    自动连接用户指定的云搜索服务集群并在Elasticsearch中创建索引,索引数据存放在Elasticsearch。同时,HBase的原生API(put和scan接口)支持索引数据的写入和查询。 使用方法 使用HBase Shell进行全文索引 Java应用程序开发 您可以通过开发HBase

    且提供了各种标准的词典。 保存搜索优化后的预处理文档。 比如,每个文档可以呈现为标准化词素的有序组合。伴随词素,通常还需要存储词素位置信息以用于邻近排序。因此文档包含的查询词越密集其排序越高。 词典能够对token如何标准化做到细粒度控制。使用合适的词典,可以定义不被索引的停用词。

    介绍 Picard是一组命令行工具,用于处理高通量排序(HTS)数据和格式,例如SAM / BAM / CRAM和VCF。 关于Picard的更多信息请访问Picard官网。 语言:java 一句话描述:用于处理HTS数据和格式的工具。 开源协议:MIT 建议的版本 建议使用版本为“Picard

    // Integer | 查询条数限制

    String order = "asc"; // String | 查询结果排序, 升序和降序两种可选

    FlinkJobTemplateListResponse result = client.getFlinkJobTemplates(offset

    N不是很大时,可以先使用mapPartitions对每个partition求TopN,collect结果到本地之后再做排序取TopN。这样相比直接对全量数据做排序取TopN效率要高很多。 使用coalesce调整分片的数量 coalesce可以调整分片的数量。coalesce函数有两个参数

    Graylog是一个开源的日志聚合、分析、审计、显示和预警工具。 Graylog完全基于Java代码编写,运行时需要依赖JDK。本文以openjdk on arm为例介绍如何在鲲鹏生态中使用Graylog。 语言:Java 一句话描述:一个开源的日志聚合、分析工具 建议的版本 建议

    展开全文
  • SearchResponse sr = transportClient.prepareSearch("videonew").setTypes("videonew").setQuery(rangeQueryBuilder).setSize(0) .addAggregation( //按照displayName.displayName做聚合聚合结果倒序排序 ...

    public void getResult() {

    String beanName = "ppcOnlineEs";

    int size = 1000000;

    EsIndexClientBean esIndexClientBean = (EsIndexClientBean) context.getBean(beanName);

    TransportClient transportClient = esIndexClientBean.getTransportClient();

    org.elasticsearch.index.query.RangeQueryBuilder rangeQueryBuilder = QueryBuilders.rangeQuery("createTime");

    rangeQueryBuilder.includeUpper(true).includeLower(true).from("2017-06-06 00:00:00").to("2017-11-06 00:00:00");

    SearchResponse sr = transportClient.prepareSearch("videonew").setTypes("videonew").setQuery(rangeQueryBuilder).setSize(0)

    .addAggregation(

    //按照displayName.displayName做聚合,聚合结果倒序排序

    AggregationBuilders.terms("by_displayName").field("displayName.displayName").order(Terms.Order.count(false)).size(size)).execute().actionGet();

    Map aggregationMap = sr.getAggregations().getAsMap();

    //获取聚合结果

    Aggregation agg = aggregationMap.get("by_displayName");

    String outfileName = "C:\\重复.txt";

    try {

    BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(outfileName))));

    int count = 0;

    for (Terms.Bucket entry : ((StringTerms) agg).getBuckets()) {

    count++;

    String key = entry.getKeyAsString(); // bucket key

    long docCount = entry.getDocCount(); // Doc count

    if (docCount < 2) {

    break;

    }

    StringBuilder sb = new StringBuilder();

    sb.append( key + "\t" + docCount);

    bw.write(sb.toString());

    bw.newLine();

    if(count%1000==0)

    {

    bw.flush();

    }

    }

    bw.flush();

    bw.close();

    } catch (Exception e)

    {

    e.printStackTrace();

    }

    }

    展开全文
  • 基于词根的聚合,如果聚合字段是text的话,会对一个一个的词根进行聚合,通常不会在text类型的字段上使用聚合,对标关系型数据中的(Group By)。官方示例如下:1GET/_search2{3"aggs":{4"genres":{5"terms":{"field":...

    多值聚合,根据库中的文档动态构建桶。基于词根的聚合,如果聚合字段是text的话,会对一个一个的词根进行聚合,通常不会在text类型的字段上使用聚合,对标关系型数据中的(Group By)。

    官方示例如下:

    1GET /_search2{3    "aggs" : {4        "genres" : {5            "terms" : { "field" : "genre" }6        }7    }8}

    返回结果如下:

     1{ 2    ... 3    "aggregations" : { 4        "genres" : { 5            "doc_count_error_upper_bound": 0,           // @1 6            "sum_other_doc_count": 0,                         // @2 7            "buckets" : [                                                 // @3 8                { 9                    "key" : "electronic",10                    "doc_count" : 611                },12                {13                    "key" : "rock",14                    "doc_count" : 315                },16                {17                    "key" : "jazz",18                    "doc_count" : 219                }20            ]21        }22    }23}

    返回结果@1:该值表示未进入最终术语列表的术语的最大潜在文档计数,下文还会详细分析。返回结果@2:当有很多词根时,Elasticsearch只返回最上面的项;这个数字是所有不属于响应的bucket的文档计数之和,其搜索过程在下文会讲到。返回结果@3:返回的结果,默认情况下,返回doc_count排名最前的10个,受size参数的影响,下面会详细介绍。

    Terms 聚合支持如下常用参数:

    • size可以通过size返回top size的文档,该术语聚合针对顶层术语(不包含嵌套词根),其搜索过程是将请求向所有分片节点发送请求,每个分片节点返回size条数据,然后聚合所有分片的结果(会对各分片返回的同样词根的数数值进行相加),最终从中挑选size条记录返回给客户端。从这个过程也可以看出,其结果并不是准确的,而是一个近似值。
    • Shard Size为了提高该聚合的精确度,可以通过shard_size参数设置协调节点向各个分片请求的词根个数,然后在协调节点进行聚合,最后只返回size个词根给到客户端,shard_size >= size,如果shard_size设置小于size,ES会自动将其设置为size,默认情况下shard_size建议设置为(1.5 * size + 10)。

    Calculating Document Count Error

    为了阐述返回结果中的doc_count_error_upper_bound、sum_other_doc_count代表什么意思,我们通过如下例子来说明Term Aggregations的工作机制。

    例如在三个分片上关于产品的初始聚合信息如下:

    在这里插入图片描述


    现在统计size=5的term Aggregations,协调节点向Shard A、B、C分别请求前5条聚合信息,如下图所示:
    在这里插入图片描述
    根据这些返回的结果,在协调节点上聚合,最终得出如下响应结果:

     1{ 2    ... 3    "aggregations" : { 4        "products" : { 5            "doc_count_error_upper_bound" : 46, 6            "sum_other_doc_count" : 79, 7            "buckets" : [ 8                { 9                    "key" : "Product A",10                    "doc_count" : 10011                },12                {13                    "key" : "Product Z",14                    "doc_count" : 5215                }16                {17                    "key" : "Product C",18                    "doc_count" : 5019                }20                {21                    "key" : "Product G",22                    "doc_count" : 4523                }24                ...25            ]26        }27    }28}

    那doc_count_error_upper_bound、sum_other_doc_count又分别代表什么呢?

    • doc_count_error_upper_bound该值表示未进入最终术语列表的术语的最大潜在文档计数。这是根据从每个碎片返回的上一项的文档计数之和计算的(协调节点根据每个分片节点返回的最后一条数据相加得来的)。这意味着在最坏的情况下,没有返回的词根的最大文档个数为46个,在此次聚合结果中排名第4。
    • sum_other_doc_count未纳入本次聚合结果中的文档总数量,这个容易理解。

    Per bucket Document Count Error

    每个桶的错误文档数量,可以通过参数show_term_doc_count_error=true来展示每个文档未被纳入结果集的数量。

    其使用示例如下:

     1GET /_search 2{ 3    "aggs" : { 4        "products" : { 5            "terms" : { 6                "field" : "product", 7                "size" : 5, 8                "show_term_doc_count_error": true 9            }10        }11    }12}

    对应的返回值:

     1{ 2    ... 3    "aggregations" : { 4        "products" : { 5            "doc_count_error_upper_bound" : 46, 6            "sum_other_doc_count" : 79, 7            "buckets" : [ 8                { 9                    "key" : "Product A",10                    "doc_count" : 100,11                    "doc_count_error_upper_bound" : 012                },13                {14                    "key" : "Product Z",15                    "doc_count" : 52,16                    "doc_count_error_upper_bound" : 217                }18                ...19            ]20        }21    }22}

    order

    可以设置桶的排序,默认是按照桶的doc_count降序排序的。order的可选值:

    1. "order" : { "_count" : "asc" }
    2. "order" : { "_key" : "asc" }
    3. 支持子聚合的结果作为排序字段。
     1GET /_search 2{ 3    "aggs" : { 4        "genres" : { 5            "terms" : { 6                    "field" : "genre", 7                     "order" : { "max_play_count" : "desc" }  //  "order" : { "playback_stats.max" : "desc" } 8            }, 9            "aggs" : {10                "max_play_count" : { "max" : { "field" : "play_count" } }   // "playback_stats" : { "stats" : { "field" : "play_count" } }11            }12        }13    }14}

    "order" : { "playback_stats.max" : "desc" }其中键的书写规则如下:用 > 分隔聚合名称,用.分开METRIC类型的聚合。

    Minimum document count

    通过指定min_doc_count来过滤匹配文档数量小于该值的桶。

    Filtering values(值过滤)

    对值使用正则表达式进行过滤,示例如下:

     1GET /_search 2{ 3    "aggs" : { 4        "tags" : { 5            "terms" : { 6                "field" : "tags", 7                "include" : ".*sport.*",    //   include 包含 8                "exclude" : "water_.*"    //   exclude 排除 9            }10        }11    }12}

    精确值匹配

    1"JapaneseCars" : {2    "terms" : {3        "field" : "make",4        "include" : ["mazda", "honda"]5    }6}

    分区过滤:

     1GET /_search 2{ 3   "size": 0, 4   "aggs": { 5      "expired_sessions": { 6         "terms": { 7            "field": "account_id", 8            "include": { 9               "partition": 0,                          // @110               "num_partitions": 20               // @211            },12            "size": 10000,13            "order": {14               "last_access": "asc"15            }16         },17         "aggs": {18            "last_access": {19               "max": {20                  "field": "access_date"21               }22            }23         }24      }25   }26}

    分区的意思就是将值分成多个组,没一个请求只处理其中一个组,其中参数 @1表示请求的分组ID,num_partitions表示总共的分组数。

    Multi-field terms aggregation

    多字段词根聚合。terms aggregation不支持从同一文档中的多个字段收集词根。因为terms aggregation本身并不收集所有的词根,而是使用全局序数来生成字段中所有惟一值的列表。全局序数会带来重要的性能提升,而这在多个字段中是不可能实现的。

    有两种方法可以用于跨多个字段执行term aggregation:

    • script使用脚本方式,目前暂不探讨其脚本的使用。
    • copy_to field使用copy_to在映射中聚合多个字段。

    Collect mode

    收集模式,ES支持两种收集模式:

    • depth_first:深度优先,默认值。
    • breadth_first:广度优先。

    首先我们先学习一下树的基本知识(深度遍历与广度遍历),例如有如下一颗二叉树:

    8297851770e02af346aca357ca1bc017.png


    深度遍历:深度遍历是从一个节点开始,先遍历完该节点所有的子节点,然后再返回遍历它的兄弟节点,通常深度遍历分为中序遍历、前序遍历,后序遍历。

    • 中序遍历(遍历左子树–>访问根–>遍历右子树):D B E A F C G
    • 前序遍历(访问根–>遍历左子树–>遍历右子树):A B D E C F G
    • 后序遍历(遍历左子树–>遍历右子树–>访问根):D E B F G C A
    • 广度遍历(一层一层遍历):A B C D E F G

    广度优先聚合与深度优先聚合的构建流程(聚合流程)与其遍历顺序一致。

    下面我们以官方的示例来进一步说明:

    例如现在有一个电影的文档,其索引中的数据如下:

    cdd30707371a822c12566da822c5c8e6.png


    现在要统计出演电视剧最多的演员(前3),并且和这些演员合作次数最多的演员。
    其聚合语法如下:

     1GET /_search 2{ 3    "aggs" : { 4        "actors" : {  5             "terms" : { 6                 "field" : "actors", 7                 "size" : 3, 8                 “shard_size” : 50 9                 "collect_mode" : "breadth_first" 10             },11            "aggs" : {12                "costars" : {   // 子聚合13                     "terms" : {14                         "field" : "actors",15                         "size" : 516                     }17                 }18            }19         }20    }21}

    对应的JAVA示例如下:

     1public static void test_term_aggregation_collect_mode() { 2        RestHighLevelClient client = EsClient.getClient(); 3        try { 4 5            SearchRequest searchRequest = new SearchRequest(); 6            searchRequest.indices("movies_index"); 7            SearchSourceBuilder sourceBuilder = new SearchSourceBuilder(); 8            AggregationBuilder aggregationBuild = AggregationBuilders.terms("actors_agg") 9                                                        .field("actors")10                                                        .size(3)11                                                        .shardSize(50)12                                                        .collectMode(SubAggCollectionMode.BREADTH_FIRST)13                                                        .subAggregation(AggregationBuilders.terms("costars_agg")14                                                                .field("actors")15                                                                .size(3))16                                                  ;17            sourceBuilder.aggregation(aggregationBuild);18            sourceBuilder.size(0);1920            searchRequest.source(sourceBuilder);21            SearchResponse result = client.search(searchRequest, RequestOptions.DEFAULT);22            System.out.println(result);23        } catch (Throwable e) {24            e.printStackTrace();25        } finally {26            EsClient.close(client);27        }28    }

    返回结果如下:

     1{ 2   ... // 省略 3    "aggregations":{ 4        "sterms#actors_agg":{ 5            "doc_count_error_upper_bound":0, 6            "sum_other_doc_count":30, 7            "buckets":[ 8                { 9                    "key":"赵丽颖",10                    "doc_count":3,11                    "sterms#costars_agg":{12                        "doc_count_error_upper_bound":0,13                        "sum_other_doc_count":19,14                        "buckets":[15                            {16                                "key":"赵丽颖",17                                "doc_count":318                            },19                            {20                                "key":"俞灏明",21                                "doc_count":122                            },23                            {24                                "key":"冯绍峰",25                                "doc_count":126                            }27                        ]28                    }29                },30                {31                    "key":"李亚鹏",32                    "doc_count":2,33                    "sterms#costars_agg":{34                        "doc_count_error_upper_bound":0,35                        "sum_other_doc_count":8,36                        "buckets":[37                            {38                                "key":"李亚鹏",39                                "doc_count":240                            },41                            {42                                "key":"吕丽萍",43                                "doc_count":144                            },45                            {46                                "key":"周杰",47                                "doc_count":148                            }49                        ]50                    }51                },52                {53                    "key":"俞灏明",54                    "doc_count":1,55                    "sterms#costars_agg":{56                        "doc_count_error_upper_bound":0,57                        "sum_other_doc_count":5,58                        "buckets":[59                            {60                                "key":"俞灏明",61                                "doc_count":162                            },63                            {64                                "key":"刘凡菲",65                                "doc_count":166                            },67                            {68                                "key":"孟瑞",69                                "doc_count":170                            }71                        ]72                    }73                }74            ]75        }76    }77}

    深度遍历优先的执行路径:

    开始对整个电影库进行搜索,从文档中得出第一个影员,例如赵丽颖,然后立马执行子聚合,首先刷选出有赵丽颖参与的文档集中的词根,并聚合其数量,排名前3的组成一个聚合结果,生成类似于:

     1 { 2                    "key":"赵丽颖", 3                    "doc_count":3, 4                    "sterms#costars_agg":{ 5                        "doc_count_error_upper_bound":0, 6                        "sum_other_doc_count":19, 7                        "buckets":[ 8                            { 9                                "key":"赵丽颖",10                                "doc_count":311                            },12                            {13                                "key":"俞灏明",14                                "doc_count":115                            },16                            {17                                "key":"冯绍峰",18                                "doc_count":119                            }20                        ]21                    }22                }

    然后再返回上一层聚合,再对上一层的下一个词根执行类似的聚合,最后进行排序,在第一层进行裁剪(刷选)前size个文档返回个客户端。

    广度遍历优先的执行路径:

    首先执行第一层聚合,也就是针对所有文档中的actors字段进行聚合,得到文档集中所有的演员,然后按doc_count排序,进行裁剪,刷选前3个演员,然后只针对这3个演员进行第二层聚合。

    看上去广度遍历优先会非常高效,其实这里掩藏了一个实现细节,就是广度优先,会缓存裁剪后剩余的所有文档,也就是本例中与这3个演员的所有文档集在内存中,然后基于这些内存执行第二层聚合,故如果第一层每个桶如果包含的文档数量巨大,则会耗费很大的内存,容易触发OOM异常,故广度优先的使用场景是子聚合所需要处理的数据很少的情况下会非常高效。

    参考知识:http://www.cnblogs.com/bonelee/p/7832738.html

    execution hint

    执行提示,类似于MySQL数据库的hint功能。

    Term Aggregation聚合通常基于如下两种实现方式:

    1. 通过直接使用字段值来聚合每个桶的数据(map)只有当很少的文档匹配查询时,才应该考虑映射。否则,基于序号的执行模式会快得多。默认情况下,map只在脚本上运行聚合时使用,因为它们没有序号。
    2. 通过使用字段的全局序号并为每个全局序号分配一个bucket (global_ordinals)keyword类型的字段默认使用global_ordinals机制,它使用全局序号动态分配bucket,因此内存使用与属于聚合范围的文档的值的数量是线性的。

    默认情况下,ES会自动选择,但也可以通过参数execution_hint进行人工干预,可选值:global_ordinals、map。

    Missing value

    missing定义了应该如何处理缺少值的文档。默认情况下,它们将被忽略,但也可以将它们视为具有一个值。Terms Aggregation聚合就介绍到这里了。

    Significant Terms(聚合)

    返回集合中出现的有趣或不寻常的项的聚合。

    首先从官方示例开始学习。

    官方示例的索引结构大概如下(类似一个全国犯罪事件索引库)核心字段:force:接案警局名称。crime_type:犯罪类型。

    Single-Set analysis

    单一结果集分析,通常前台集合(foreground set)通常通过一组查询条件指定。请看示例:

     1GET /_search 2{ 3    "query" : {    // @1 4        "terms" : {"force" : "上海交通警局"  5    }, 6    "aggregations" : { 7        "significant_crime_types" : { 8            "significant_terms" : { "field" : "crime_type" }     // @2 9        }10    }11}

    代码@1:定义一个查询,该例中查询警局为“ShangHai Transport Police”所有犯罪记录,当成我们关注(感兴趣的集合,也就是Significant Terms Aggregation中的(foreground set)。

    代码@2:对crime_type犯罪类型进行significant_terms.

    返回结果如下:

     1{ 2    ... 3    "aggregations" : { 4        "significant_crime_types" : { 5            "doc_count": 47347,                                     // @1 6            "bg_count": 5064554,                                   // @2 7            "buckets" : [                                                   // @3 8                { 9                    "key": "自行车盗窃案",                    10                    "doc_count": 3640,                               // @411                    "score": 0.371235374214817,12                    "bg_count": 66799                                // @513                }14                ,15                {16                    "key": "小汽车盗窃案",             17                    "doc_count": 6640,18                    "score": 0.371235374214815,19                    "bg_count": 6679920                }21                ...22            ]23        }24    }25}

    代码@1:doc_count:符合查询条件的总文档数量,此例表示上海交通警局总共的犯罪记录数。代码@2:bg_count:这是Significant Terms中的background set,应该是该索引当前总共的文档个数。代码@3:是significant_terms针对犯罪类型的聚合结果。代码@4:表示上海交通警局总共发生的自行车盗窃案的总记录数。代码@5:表示整个索引库中所有警局发生的自行车盗窃案的总记录数。

    从这里的结果,我们可以得出如下结论:

    整体自行车犯罪率= 66799/5064554,约等于1%。

    上海交通警局自行车盗窃犯罪率(上海交通警局自行车犯罪总记录数除以上海交通警局的总犯罪记录)=3640/47347约等于7%。

    使用这种查询来找出异常数据,但它只给了我们一个用于比较的子集。要发现所有其他警察部队的异常情况,我们必须对每个不同的警察部队重复查询。

    如何解决该问题呢?请看下文。

    Multi-set analysis

    多结果集对比分析,其思路是通过term aggregation产生多个桶(多个数据集合),然后再使用子聚合针对这些分组再进行一次聚合。

    跨多个类别执行分析的一种更简单的方法是使用父级聚合来分割准备分析的数据。使用父聚合进行分割的示例:

     1GET /_search 2{ 3    "aggregations": { 4        "forces": { 5            "terms": {"field": "force"},                  // @1 6            "aggregations": { 7                "significant_crime_types": {         // @2 8                    "significant_terms": {"field": "crime_type"} 9                }10            }11        }12    }13}

    代码@1:首先对字段force进行term聚合,统计各个警局的犯罪记录总数。代码@2:然后子聚合是对犯罪类型进行significant_terms聚合。

    我们先来看一下返回结果:

     1{ 2 ... 3 "aggregations": { 4    "forces": { 5        "doc_count_error_upper_bound": 1375, 6        "sum_other_doc_count": 7879845, 7        "buckets": [ 8            { 9                "key": "广州交通警局",10                "doc_count": 894038,11                "significant_crime_types": {    12                    "doc_count": 894038,        // @113                    "bg_count": 5064554,        // @214                    "buckets": [                         // @315                        {16                            "key": "抢劫",        // @417                            "doc_count": 27617,   // @518                            "score": 0.0599, 19                            "bg_count": 53182      // @620                        }21                        ...22                }23            }// 省略其他警局的数据。24        ]25    }26  }27}

    主要针对significant_crime_types的结果集做一次解释:结果@1:"广州交通警局"总处理犯案记录总数为894038。结果@2:索引库总处理犯案记录总数为5064554。结果@3:"广州交通警局"各个犯案类型的聚合数据。结果@4:犯罪类型(crime_type)为“抢劫”类型的聚合数据。结果@5:"广州交通警局" “抢劫”类案的处理条数为27617。结果@6:索引库总处理犯罪类型为“抢劫”的总数为53182 。

    Significant聚合的分数如何计算

    如果术语在子集中(foreground set)出现的频率和在背景中(background sets)出现的频率有显著差异,则认为该术语是重要的。

    Custom background sets

    定制background sets集合。通常情况下,ES的Significant聚合使用整个索引库的内容当成background sets(背景集合),可以通过background_filter参数来指定,其使用示例如下:

    Significant Terms Aggregation限制

    • 聚合字段必须是索引的
    • 不支持浮点类型字段聚合。
    • 由于Significant Terms Aggregation聚合的background sets是整个索引文档,故如果用作foreground set的查询返回结果也是整个文档集合(match_all)的话,该聚合则失去意义。
    • 如果有相当于match_all查询没有查询条件提供索引的一个子集significant_terms聚合不应该被用作最顶部的聚合——在这个场景中前景是完全一样的背景设定,所以没有文档频率的差异来的观察和合理建议。

    与Terms Aggregation一样,其结果是近似值,可以通过size、shard_size来控制其精度。

    另一个需要考虑的问题是,significant_terms聚合在切分级别上生成许多候选结果,只有在合并所有切分的统计信息之后,才会在reduce节点上对这些结果进行修剪。因此,就RAM而言,将大型子聚合嵌入到一个重要的_terms聚合(稍后将丢弃许多候选项)下是低效且昂贵的。在这种情况下,最好执行两个搜索——第一个搜索提供一个合理的重要术语列表,然后将这个术语短列表添加到第二个查询中,以返回并获取所需的子聚合。

    Significant Terms Aggregation支持Terms Aggregation定义的参数,诸如size、sharding_size、missing、collect_mode、execution_hint、min_doc_count等参数。

    展开全文
  • 微信公众号:[中间件兴趣圈]关于作者:《RocketMQ技术...基于词根的聚合,如果聚合字段是text的话,会对一个一个的词根进行聚合,通常不会在text类型的字段上使用聚合,对标关系型数据中的(Group By)。官方示例如...
  • es的aggs可以分为度量聚合和桶聚合,下面就直接实战开发中经常用到的语句。1、度量聚合:min、max、sum、avg聚合, 度量聚合接收一个输入文档集并生成至少一个统计值sum。1)sum聚合统计不同日志类型的总数量sum...
  • 什么是聚合(Aggregation)1.elasticsearch 除了搜索以外,提供的针对ES数据进行统计分析的功能实时性高、Hadoop(T+1)2.通过聚合,我们会得到一个数据的概览,是分析和总结全套的数据,而不是寻找单个文档。3.高性能,...
  • 欢迎关注我的头条号:Wooola,10年Java软件开发及架构...前言最近使用es 6.x版本统计网站访问次数时,提示提示Fielddata is disabled错误NotSerializableExceptionWrapper[: Fielddata is disabled on text fields...
  • es查询的索引的company,其有如下字段,下面是一个示例数据"id": "1", //id"name": "张三",//姓名"sex": "男",//性别"age": 49,//年龄"birthday": "1970-01-01",//生日"position": "董事长",//职位"joinTime": ...
  • elasticsearch是什么elasticsearch是一款大数据场景下的分布式全文搜索、统计分析引擎elasticsearch提供了什么功能1. 数据存储针对大数据的具有容错机制的分布式存储功能,数据存储的原理将在该系列的其他文章中单独...
  • 一、前言数据平台已迭代三个版本,从头开始遇到很多常见的难题,整理一些已完善的文档,在此分享以供所需朋友的实现参考,少走些弯路,在此篇幅中偏重于ES的优化,关于HBase,Hadoop的设计优化估计有很多文章可以...
  • 数据平台已迭代三个版本,从头开始遇到很多常见的难题,终于有片段时间整理一些已完善的文档,在此分享以供所需朋友的实现参考,少走些弯路,在此篇幅中偏重于ES的优化,关于HBase,Hadoop的设计优化估计有很多文章...
  • 聚合有助于从搜索中使用的查询中收集数据,聚合为各种统计指标,便于统计信息或做其他分析。聚合可帮助回答以下问题: 我的网站平均加载时间是多少? 根据交易量,谁是我最有价值的客户? 什么会被视为我网络上的大...
  • 云搜索服务 CSS云搜索服务是一个基于Elasticsearch且完全托管的在线分布式搜索服务,为用户提供结构化、非结构化文本的多条件检索、统计、报表。完全兼容开源Elasticsearch软件原生接口。它可以帮助网站和APP搭建...
  • 我目前是初学ES,想将其应用在实数据分析的项目中,所以进行了项目中常见的复杂聚合操作,但是我目前在排序上遇到了困难,各种度娘谷歌够未能解决。具体场景如下:索引 visited_data 存放的是用户访问数据visitor_id...
  • java ElasticSearch es 聚合排序

    千次阅读 2019-06-12 15:18:47
    近来一直在javaAPI对ES数据进行统计分析, 中间也遇到不少问题, 本篇文章只针对聚合过程中的排序方法进行总结 例如:selectavg(age) as avg_age from table group by gender; 聚合的两种排序方式 1. 按组内字段...
  • 当字段被排序聚合或者通过脚本访问时这种数据结构会被创建。它是通过从磁盘读取每个段的整个反向索引来构建的,然后存存储在java的堆内存中。  fileddata默认是不开启的。Fielddata可能会消耗大量的堆空间,尤其...
  • ES-聚合

    2021-01-18 19:55:49
    再嵌套条形图按时间统计返回空Buckets限定范围的聚合过滤和聚合过滤过滤桶后过滤器小结多桶排序内置排序按度量排序基于“深度”度量排序近似聚合统计去重后对数量百分位计算通过聚合发现异常指标演示Doc Values and ...
  • 需要实现:分组,求和,聚合排序,总计,分页 二, 需求分析:关于分组维度 es数据主键为:日期(年月日)+采购组织+采购组+门店 统计维度:可根据是否选择门店,按日或按月统计可分为四种情况 日+采购组织...
  • es聚合查询与多维度数据统计

    万次阅读 多人点赞 2019-07-28 10:16:06
    根据业务需求,对文档中的某个或某几个字段进行数据的分组并做一些指标数据的统计分析,比如要计算一批文档中某个业务字段的总数,平均数,最大最小值等,都属于聚合的范畴 以上两个概念后是理解下...
  • 再聚合1.3 扩展: fielddata和keyword的聚合比较2 嵌套聚合2.1 先分组, 再聚合统计2.2 先分组, 再统计, 最后排序2.3 先分组, 组内再分组, 然后统计、排序1 普通聚合分析1.1 直接聚合统计(1) 计算每个tag下的文档数量...
  • 文章目录一、es基础:轻量查询1、 增`PUT index_name/type_name/...bulk:批量添加数据`2.2 `_mapping操作`2.3 简单聚合2.4 添加度量指标聚合2.5 嵌套桶统计最大最小值2.6 按时间聚合统计每月汽车销量多条件时间聚合 一
  • 1.1 直接聚合统计 1.2 先检索, 再聚合 1.3 扩展: fielddata和keyword的聚合比较 2 嵌套聚合 2.1 先分组, 再聚合统计 2.2 先分组, 再统计, 最后排序 2.3 先分组, 组内再分组, 然后统计、排序 1 普通聚合分析...
  • Elasticsearch 桶聚合 SQL DSL JavaAPI1 准备测试数据1.1 插入数据DSL1.2 表格展示2 Terms Aggregation(根据字段的值分组)2.1 根据dept分组,...并排序2.2.1 SQL2.2.2 DSL2.3 对统计结果过滤,加having2.3.1 SQL2...
  • ElasticSearch里面的聚合机制非常灵活和强大,今天我们来看下如何在ElasticSearch里面实现分组后,根据sum值进行排序?类似的数据库SQL如下:select id,sum(c1) as c1 , sum(c2) as c2 from table1 group id order ...
  • 文章目录1、统计每个标签对应的商品数量2、对商品名称包含shu的商品,统计每个标签对应的商品数量3、计算每个标签对应的商品的平均价格4、计算每个标签对应的商品的平均价格并按平均价格降序排序5、按价格区间进行...
  • elasticsearch6聚合排序总结 - JavaAPI

    千次阅读 2018-09-12 15:13:21
     近来一直在javaAPI对ES数据进行统计分析, 中间也遇到不少问题, 本篇文章只针对聚合过程中的排序方法进行总结 例如:select avg(age) as avg_age from table group by gender;   聚合的两种排序方式  1. 按组...
  • 目录 1.简介 1.1.桶 1.2.指标 1.3.桶和指标的组合 1.4.聚合 ...1.8.按时间统计 ...1.9.范围限定的聚合 ...1.10.过滤和聚合 ...1.11.多桶排序 ...内置排序 ...按度量排序 ...基于“深度”度量排序 ...1.12.近似聚合 ...统计...
  • spring data es实现方式:TypedAggregation agg = Aggregation.newAggregation(Album.class,Aggregation.project("id","albumName","coverImgId").and("countRead").plus("countComment").plus("countLike").as(...

空空如也

空空如也

1 2 3
收藏数 47
精华内容 18
关键字:

es排序聚合统计