Elasticsearch中的聚合

Question

我有一個elasticsearch查詢，它返回一堆看起來像這樣的對象：

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 1,
    "hits": [
      {
        "_index": "searchdb",
        "_type": "profile",
        "_id": "1825",
        "_score": 1,
        "_source": {
          "id": 1825,
          "market": "Chicago",
          "geo_location": {
            "lat": 41.1234,
            "lon": -87.5678
          },
          "hourly_values": [
            {
              "datetime": "1997-07-16T19:00:00.00+00:00",
              "seconds": 1200
            },
            {
              "datetime": "1997-07-16T19:20:00.00+00:00",
              "seconds": 1200
            },
            {
              "datetime": "1997-07-16T19:20:00.00+00:00",
              "seconds": 1200
            }
          ]
        }
      },
      {
        "_index": "searchdb",
        "_type": "profile",
        "_id": "1808",
        "_score": 1,
        "_source": {
          "id": 1808,
          "market": "Chicago",
          "geo_location": {
            "lat": 41.1234,
            "lon": -87.5678
          },
          "hourly_values": [
            {
              "datetime": "1997-07-16T19:00:00.00+00:00",
              "seconds": 900
            },
            {
              "datetime": "1997-07-16T19:20:00.00+00:00",
              "seconds": 1200
            },
            {
              "datetime": "1997-07-16T19:20:00.00+00:00",
              "seconds": 800
            }
          ]
        }
      }
    ]
  }

我想返回相同的結果，但返回的每個對象的秒字段匯總在一起。

我的查詢現在看起來像這樣：

{
    "query": {
        "filtered":{
            "filter":{
                "geo_distance":{
                    "distance":"1km",
                    "geo_location":{
                        "lat":"41.1234",
                        "lon":"-87.5678"
                    }
                }
            }
        }
    },
    "aggregations": {
        "seconds_sum": {
           "sum": {
              "field": "hourly_values.seconds"
            }
        }
    }
} 

上面只是將所有對象的所有秒匯總在一起。 我無法弄清楚如何僅聚合每個對象的秒數，並隨該對象返回該聚合，因此我可以得到如下結果：

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 1,
    "hits": [
      {
        "_index": "searchdb",
        "_type": "profile",
        "_id": "1825",
        "_score": 1,
        "_source": {
          "id": 1825,
          "market": "Chicago",
          "geo_location": {
            "lat": 41.1234,
            "lon": -87.5678
          },
          "seconds":3600
        }
      },
      {
        "_index": "searchdb",
        "_type": "profile",
        "_id": "1808",
        "_score": 1,
        "_source": {
          "id": 1808,
          "market": "Chicago",
          "geo_location": {
            "lat": 41.1234,
            "lon": -87.5678
          },
          "seconds":2900
        }
      }
    ]
  }

或類似的東西 ...

Answer 1

那很容易。 首先，您需要將hourly_values存儲為嵌套對象 。

您必須使用條款按唯一值進行匯總，在這種情況下，它可能會是id，只有這樣您才可以求和 。 總結一下：

那就是你的映射

PUT /test
{
  "mappings": {
    "data": {
      "properties": {
        "id": {
          "type": "integer"
        },
        "geo_location": {
          "type": "geo_point"
        },
        "hourly_values": {
          "type": "nested",
          "properties": {
            "datetime": {
              "type": "date"
            },
            "seconds": {
              "type": "integer"
            }
          }
        }
      }
    }
  }
}

測試數據

PUT /test/data/1
{
  "id": 1825,
  "market": "Chicago",
  "geo_location": {
    "lat": 41.1234,
    "lon": -87.5678
  },
  "hourly_values": [
    {
      "datetime": "1997-07-16T19:00:00.00+00:00",
      "seconds": 1200
    },
    {
      "datetime": "1997-07-16T19:20:00.00+00:00",
      "seconds": 1200
    },
    {
      "datetime": "1997-07-16T19:20:00.00+00:00",
      "seconds": 1200
    }
  ]
}

PUT /test/data/2
{
  "id": 1808,
  "market": "Chicago",
  "geo_location": {
    "lat": 41.1234,
    "lon": -87.5678
  },
  "hourly_values": [
    {
      "datetime": "1997-07-16T19:00:00.00+00:00",
      "seconds": 900
    },
    {
      "datetime": "1997-07-16T19:20:00.00+00:00",
      "seconds": 1200
    },
    {
      "datetime": "1997-07-16T19:20:00.00+00:00",
      "seconds": 800
    }
  ]
}

和你的聚合

POST /test/_search
{
  "size": 0,
  "aggs": {
    "Ids": {
      "terms": {
        "field": "id",
        "size": 0
      },
      "aggs": {
        "Nesting": {
          "nested": {
            "path": "hourly_values"
          },
          "aggs": {
            "SumSeconds": {
              "sum": {
                "field": "hourly_values.seconds"
              }
            }
          }
        }
      }
    }
  }
}

這將帶回您想要的結果

{
  "took": 7,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "Ids": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": 1808,
          "doc_count": 1,
          "Nesting": {
            "doc_count": 3,
            "SumSeconds": {
              "value": 2900
            }
          }
        },
        {
          "key": 1825,
          "doc_count": 1,
          "Nesting": {
            "doc_count": 3,
            "SumSeconds": {
              "value": 3600
            }
          }
        }
      ]
    }
  }
}

如果您也想將文檔返回到它們旁邊，則可以將Top Hit的聚合與嵌套總和一起使用：

POST /test/_search
{
  "size": 0,
  "aggs": {
    "Ids": {
      "terms": {
        "field": "id",
        "size": 0
      },
      "aggs": {
        "Objects": {
          "top_hits": {
            "_source": ["id", "market", "geo_location"],
            "size": 1
          }
        },
        "Nesting": {
          "nested": {
            "path": "hourly_values"
          },
          "aggs": {
            "SumSeconds": {
              "sum": {
                "field": "hourly_values.seconds"
              }
            }
          }
        }
      }
    }
  }
}

這會帶回它：

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "Ids": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": 1808,
          "doc_count": 1,
          "Nesting": {
            "doc_count": 3,
            "SumSeconds": {
              "value": 2900
            }
          },
          "Objects": {
            "hits": {
              "total": 1,
              "max_score": 1,
              "hits": [
                {
                  "_index": "test",
                  "_type": "data",
                  "_id": "2",
                  "_score": 1,
                  "_source": {
                    "market": "Chicago",
                    "geo_location": {
                      "lon": -87.5678,
                      "lat": 41.1234
                    },
                    "id": 1808
                  }
                }
              ]
            }
          }
        },
        {
          "key": 1825,
          "doc_count": 1,
          "Nesting": {
            "doc_count": 3,
            "SumSeconds": {
              "value": 3600
            }
          },
          "Objects": {
            "hits": {
              "total": 1,
              "max_score": 1,
              "hits": [
                {
                  "_index": "test",
                  "_type": "data",
                  "_id": "1",
                  "_score": 1,
                  "_source": {
                    "market": "Chicago",
                    "geo_location": {
                      "lon": -87.5678,
                      "lat": 41.1234
                    },
                    "id": 1825
                  }
                }
              ]
            }
          }
        }
      ]
    }
  }
}