Elasticsearch中的聚合

Question

我有一个elasticsearch查询，它返回一堆看起来像这样的对象：

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 1,
    "hits": [
      {
        "_index": "searchdb",
        "_type": "profile",
        "_id": "1825",
        "_score": 1,
        "_source": {
          "id": 1825,
          "market": "Chicago",
          "geo_location": {
            "lat": 41.1234,
            "lon": -87.5678
          },
          "hourly_values": [
            {
              "datetime": "1997-07-16T19:00:00.00+00:00",
              "seconds": 1200
            },
            {
              "datetime": "1997-07-16T19:20:00.00+00:00",
              "seconds": 1200
            },
            {
              "datetime": "1997-07-16T19:20:00.00+00:00",
              "seconds": 1200
            }
          ]
        }
      },
      {
        "_index": "searchdb",
        "_type": "profile",
        "_id": "1808",
        "_score": 1,
        "_source": {
          "id": 1808,
          "market": "Chicago",
          "geo_location": {
            "lat": 41.1234,
            "lon": -87.5678
          },
          "hourly_values": [
            {
              "datetime": "1997-07-16T19:00:00.00+00:00",
              "seconds": 900
            },
            {
              "datetime": "1997-07-16T19:20:00.00+00:00",
              "seconds": 1200
            },
            {
              "datetime": "1997-07-16T19:20:00.00+00:00",
              "seconds": 800
            }
          ]
        }
      }
    ]
  }

我想返回相同的结果，但返回的每个对象的秒字段汇总在一起。

我的查询现在看起来像这样：

{
    "query": {
        "filtered":{
            "filter":{
                "geo_distance":{
                    "distance":"1km",
                    "geo_location":{
                        "lat":"41.1234",
                        "lon":"-87.5678"
                    }
                }
            }
        }
    },
    "aggregations": {
        "seconds_sum": {
           "sum": {
              "field": "hourly_values.seconds"
            }
        }
    }
} 

上面只是将所有对象的所有秒汇总在一起。 我无法弄清楚如何仅聚合每个对象的秒数，并随该对象返回该聚合，因此我可以得到如下结果：

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 1,
    "hits": [
      {
        "_index": "searchdb",
        "_type": "profile",
        "_id": "1825",
        "_score": 1,
        "_source": {
          "id": 1825,
          "market": "Chicago",
          "geo_location": {
            "lat": 41.1234,
            "lon": -87.5678
          },
          "seconds":3600
        }
      },
      {
        "_index": "searchdb",
        "_type": "profile",
        "_id": "1808",
        "_score": 1,
        "_source": {
          "id": 1808,
          "market": "Chicago",
          "geo_location": {
            "lat": 41.1234,
            "lon": -87.5678
          },
          "seconds":2900
        }
      }
    ]
  }

或类似的东西 ...

Answer 1

那很容易。 首先，您需要将hourly_values存储为嵌套对象 。

您必须使用条款按唯一值进行汇总，在这种情况下，它可能会是id，只有这样您才可以求和 。 总结一下：

那就是你的映射

PUT /test
{
  "mappings": {
    "data": {
      "properties": {
        "id": {
          "type": "integer"
        },
        "geo_location": {
          "type": "geo_point"
        },
        "hourly_values": {
          "type": "nested",
          "properties": {
            "datetime": {
              "type": "date"
            },
            "seconds": {
              "type": "integer"
            }
          }
        }
      }
    }
  }
}

测试数据

PUT /test/data/1
{
  "id": 1825,
  "market": "Chicago",
  "geo_location": {
    "lat": 41.1234,
    "lon": -87.5678
  },
  "hourly_values": [
    {
      "datetime": "1997-07-16T19:00:00.00+00:00",
      "seconds": 1200
    },
    {
      "datetime": "1997-07-16T19:20:00.00+00:00",
      "seconds": 1200
    },
    {
      "datetime": "1997-07-16T19:20:00.00+00:00",
      "seconds": 1200
    }
  ]
}

PUT /test/data/2
{
  "id": 1808,
  "market": "Chicago",
  "geo_location": {
    "lat": 41.1234,
    "lon": -87.5678
  },
  "hourly_values": [
    {
      "datetime": "1997-07-16T19:00:00.00+00:00",
      "seconds": 900
    },
    {
      "datetime": "1997-07-16T19:20:00.00+00:00",
      "seconds": 1200
    },
    {
      "datetime": "1997-07-16T19:20:00.00+00:00",
      "seconds": 800
    }
  ]
}

和你的聚合

POST /test/_search
{
  "size": 0,
  "aggs": {
    "Ids": {
      "terms": {
        "field": "id",
        "size": 0
      },
      "aggs": {
        "Nesting": {
          "nested": {
            "path": "hourly_values"
          },
          "aggs": {
            "SumSeconds": {
              "sum": {
                "field": "hourly_values.seconds"
              }
            }
          }
        }
      }
    }
  }
}

这将带回您想要的结果

{
  "took": 7,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "Ids": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": 1808,
          "doc_count": 1,
          "Nesting": {
            "doc_count": 3,
            "SumSeconds": {
              "value": 2900
            }
          }
        },
        {
          "key": 1825,
          "doc_count": 1,
          "Nesting": {
            "doc_count": 3,
            "SumSeconds": {
              "value": 3600
            }
          }
        }
      ]
    }
  }
}

如果您也想将文档返回到它们旁边，则可以将Top Hit的聚合与嵌套总和一起使用：

POST /test/_search
{
  "size": 0,
  "aggs": {
    "Ids": {
      "terms": {
        "field": "id",
        "size": 0
      },
      "aggs": {
        "Objects": {
          "top_hits": {
            "_source": ["id", "market", "geo_location"],
            "size": 1
          }
        },
        "Nesting": {
          "nested": {
            "path": "hourly_values"
          },
          "aggs": {
            "SumSeconds": {
              "sum": {
                "field": "hourly_values.seconds"
              }
            }
          }
        }
      }
    }
  }
}

这会带回它：

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "Ids": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": 1808,
          "doc_count": 1,
          "Nesting": {
            "doc_count": 3,
            "SumSeconds": {
              "value": 2900
            }
          },
          "Objects": {
            "hits": {
              "total": 1,
              "max_score": 1,
              "hits": [
                {
                  "_index": "test",
                  "_type": "data",
                  "_id": "2",
                  "_score": 1,
                  "_source": {
                    "market": "Chicago",
                    "geo_location": {
                      "lon": -87.5678,
                      "lat": 41.1234
                    },
                    "id": 1808
                  }
                }
              ]
            }
          }
        },
        {
          "key": 1825,
          "doc_count": 1,
          "Nesting": {
            "doc_count": 3,
            "SumSeconds": {
              "value": 3600
            }
          },
          "Objects": {
            "hits": {
              "total": 1,
              "max_score": 1,
              "hits": [
                {
                  "_index": "test",
                  "_type": "data",
                  "_id": "1",
                  "_score": 1,
                  "_source": {
                    "market": "Chicago",
                    "geo_location": {
                      "lon": -87.5678,
                      "lat": 41.1234
                    },
                    "id": 1825
                  }
                }
              ]
            }
          }
        }
      ]
    }
  }
}