弹性搜索聚合和范围

Question

We want to aggregate some value. For example sake, let's say we are indexing users, who register in an organization.

We want to get the registered users count splitted like :

• registered from gmail : 900
• registered via fb : 800
• registered via yahoo : 700
• registered via own application : 1500
• registered via others : 1600

Expected we need to bucket 0 to 1000 users(gmail,fb,yahoo - 3 applications).And 1001 to 2000(own app,other app - 2 applications).Need to bucket like above scenario.

How do we achieve this in elastic search? Any suggestions ?

Thanks

Answer 1

Let's say you are indexing user object looks like this :

POST users/user
{
  "login":"user1",
  "organization":"fb"
}

You are trying to aggregate your users by their organization value. For this purpose, you have to use a terms aggregation.

Your query will look like :

POST users/_search?search_type=count
{
  "aggs": {
    "by_organization": {
      "terms": {
        "field": "organization"
      }
    }
  }
}

Note: the search_type=count is here only to have a shorter response as result hits won't be returned (see here ).

Your search response will be something like :

{
   (...)
   "aggregations": {
      "by_organization": {
         "doc_count_error_upper_bound": 0,
         "sum_other_doc_count": 0,
         "buckets": [
            {
               "key": "app",
               "doc_count": 4
            },
            {
               "key": "fb",
               "doc_count": 3
            },
            {
               "key": "gmail",
               "doc_count": 2
            }
         ]
      }
   }
}

You can see the buckets corresponding to the each organization value.

Be aware that:

• Only the top 10 buckets will be returned by default (see size parameter of the terms aggregation)
• This simple example works as the organization values are simple, but in real life, you will have to set your organization field to not_analyzed in order to aggregate on the original value (and not the terms obtained via analysis)

I strongly invite you to read more about analysis, and the terms aggregation documentation .