ElasticSearch 聚合

ElasticSearch 聚合 === [說明](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations.html) --- Elasticsearch將聚合分為三類： 1. Bucket Aggregations - 根據field的值、範圍或其他條件將documents分組為桶。 1. Metrics Aggregations - 從field的值計算度量，如總和或平均值。 1. Pipeline Aggregations - 匯總其他聚合ouput獲取輸入。 --- # Terms aggregation - 針對某個 field 的值進行分組，field 有幾種值就分成幾組 - terms 桶在進行分組時，會爲此 field 中的每種值創建一個新的桶 [說明](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html) --- 範例1 ```json= GET tb_inc_internal_sync-*/_search { "query": { "match_all": {} }, "size": 0, "aggs": { "my_tran_code": { "terms": { "field": "tran_code.keyword", "min_doc_count": 1, "size": 10, "order": {"_key": "asc"} } } } } ``` 參數: - min_doc_count 限制最低數量 - size 顯示 bucket 中多少筆數據，預設是 10 - order 預設是照doc_count排序 - script 可以使用腳本來組合字段再統計數量 - include/exclude 可以藉由這兩個參數filter設定的條件  --- 處理結果 ```json= "aggregations" : { "my_tran_code" : { "doc_count_error_upper_bound" : 0, "sum_other_doc_count" : 0, "buckets" : [ { "key" : "05", "doc_count" : 245 }, { "key" : "06", "doc_count" : 31 } ] } } ```  --- 範例2 將 terms 桶搭配度量指標（avg、min、max、sum…）一起使用 ```json= GET tb_inc_internal_sync-*/_search { "query": { "match_all": {} }, "size": 0, "aggs": { "my_tran_code": { "terms": { "field": "tran_code.keyword", "min_doc_count": 0 }, "aggs": { "my_avg_amt": { "avg": { "field": "src_amt" } }, "my_sum_amt": { "sum": { "field": "src_amt" } }, "my_min_amt": { "min": { "field": "src_amt" } } } } } } ```  --- ```json= "aggregations" : { "my_tran_code" : { "doc_count_error_upper_bound" : 0, "sum_other_doc_count" : 0, "buckets" : [ { "key" : "05", "doc_count" : 245, "my_min_amt" : { "value" : 500.0 }, "my_avg_amt" : { "value" : 2024105.7142857143 }, "my_sum_amt" : { "value" : 4.959059E8 } }, { "key" : "06", "doc_count" : 31, "my_min_amt" : { "value" : 500.0 }, "my_avg_amt" : { "value" : 3990.3225806451615 }, "my_sum_amt" : { "value" : 123700.0 } } ] } } ```  --- # Filter aggregation 範例 ```json= GET tb_inc_internal_sync-*/_search { "size": 0, "aggs": { "my_avg_amt": { "avg": { "field": "src_amt" } }, "my_filter": { "filter": { "term": { "tran_code": "05" } }, "aggs": { "avg_price": { "avg": { "field": "src_amt" } } } } } } ``` 結果 ```json= "aggregations" : { "my_filter" : { "doc_count" : 245, "avg_price" : { "value" : 2024105.7142857143 } }, "my_avg_amt" : { "value" : 1797208.6956521738 } } ```  --- 使用 filters aggregation 做多重過濾要使用多個過濾器對文檔進行分組，請使用 filters聚合。這比使用多個filter聚合要快。 ```json= POST /sales/_search?size=0&filter_path=aggregations { "aggs": { "f": { "filters": { "filters": { "hats": { "term": { "type": "hat" } }, "t_shirts": { "term": { "type": "t-shirt" } } } }, "aggs": { "avg_price": { "avg": { "field": "price" } } } } } } ``` 取代 ```json= POST /sales/_search?size=0&filter_path=aggregations { "aggs": { "hats": { "filter": { "term": { "type": "hat" } }, "aggs": { "avg_price": { "avg": { "field": "price" } } } }, "t_shirts": { "filter": { "term": { "type": "t-shirt" } }, "aggs": { "avg_price": { "avg": { "field": "price" } } } } } } ```  --- # Range aggregation 在聚合過程中，將從每個存儲區範圍中檢查從每個文檔中提取的值，並“存儲”相關/匹配的文檔。請注意，此聚合包括from值，但不包括to每個範圍的值。 --- 範例 ```json= GET tb_inc_internal_sync-*/_search { "size": 0, "aggs": { "amt_ranges": { "range": { "field": "src_amt", "ranges": [ { "to": 10000 }, { "from": 10000, "to": 20000 }, { "from": 20000 } ] } } } } ``` 結果 ```json= "aggregations" : { "amt_ranges" : { "buckets" : [ { "key" : "*-10000.0", "to" : 10000.0, "doc_count" : 94 }, { "key" : "10000.0-20000.0", "from" : 10000.0, "to" : 20000.0, "doc_count" : 46 }, { "key" : "20000.0-*", "from" : 20000.0, "doc_count" : 136 } ] } } ```  --- # 敬請指教 ----