DELETE cars PUT cars { "mappings": { "transactions": { "properties": { "price": { "type":"long" }, "color": { "type":"keyword" }, "make": { "type":"keyword" }, "sold": { "type":"date" } } } } } POST /cars/transactions/_bulk { "index": {}} { "price" : 10000, "color" : "red", "make" : "honda", "sold" : "2014-10-28" } { "index": {}} { "price" : 20000, "color" : "red", "make" : "honda", "sold" : "2014-11-05" } { "index": {}} { "price" : 30000, "color" : "green", "make" : "ford", "sold" : "2014-05-18" } { "index": {}} { "price" : 15000, "color" : "blue", "make" : "toyota", "sold" : "2014-07-02" } { "index": {}} { "price" : 12000, "color" : "green", "make" : "toyota", "sold" : "2014-08-19" } { "index": {}} { "price" : 20000, "color" : "red", "make" : "honda", "sold" : "2014-11-05" } { "index": {}} { "price" : 80000, "color" : "red", "make" : "bmw", "sold" : "2014-01-01" } { "index": {}} { "price" : 25000, "color" : "blue", "make" : "ford", "sold" : "2014-02-12" } ----------Filter Aggregation------- 红色车的数量 POST /cars/transactions/_search?size=0 { "aggs" : { "red_cars" : { "filter" : { "term": { "color": "red" } } } } } ----------Filters Aggregation------- 统计红色车、蓝色车各多少个 POST /cars/transactions/_search { "size": 0, "aggs" : { "cars" : { "filters" : { "filters" : { "red_cars" : { "match" : { "color" : "red" }}, "blue_cars" : { "match" : { "color" : "blue" }} } } } } } 统计红色车、蓝色车各多少个，并计算两种颜色车的平均价格 POST /cars/transactions/_search { "size": 0, "aggs" : { "cars" : { "filters" : { "filters" : { "red_cars" : { "match" : { "color" : "red" }}, "blue_cars" : { "match" : { "color" : "blue" }} } }, "aggs" : { "avg_price" : { "avg" : { "field" : "price" } } } } } } ----------Date Histogram Aggregation------- 每月销售多少台汽车 interval参数: year, quarter, month, week, day, hour, minute, second interval参数：还可以写具体的时间，比如24h,90m GET /cars/transactions/_search { "size" : 0, "aggs": { "sales_over_time": { "date_histogram": { "field": "sold", "interval": "month", "format": "yyyy-MM-dd" } } } } 指定周期90分钟 GET /cars/transactions/_search { "size" : 0, "aggs": { "sales_over_time": { "date_histogram": { "field": "sold", "interval": "90m", "format": "yyyy-MM-dd HH:mm:ss" } } } } 加入keyed参数,使返回的buckets不作为一个数组返回 GET /cars/transactions/_search { "size" : 0, "aggs": { "sales_over_time": { "date_histogram": { "field": "sold", "interval": "month", "format": "yyyy-MM-dd", "keyed":true } } } } ----------Date Range Aggregation------- 按照售卖日期范围统计车辆数量 GET /cars/transactions/_search { "size": 0, "aggs": { "range": { "date_range": { "field": "sold", "format": "yyyy-MM-dd", "ranges": [ {"from": "now-36M/M"}, {"to": "now-24M/M"}, {"from": "now-36M/M","to": "now-12M/M"} ] } } } } 加入keyed参数,使返回的buckets不作为一个数组返回，并指定key值 GET /cars/transactions/_search { "size": 0, "aggs": { "range": { "date_range": { "field": "sold", "format": "yyyy-MM-dd", "ranges": [ {"from": "now-36M/M","key":"36months"}, {"to": "now-24M/M","key":"2years_ago"}, {"from": "now-36M/M","to": "now-12M/M"} ], "keyed":true } } } } 按照售卖日期范围统计车辆数量，并计算该周期内的平均售卖价格 GET /cars/transactions/_search { "size": 0, "aggs": { "range": { "date_range": { "field": "sold", "format": "yyyy-MM-dd", "ranges": [ {"from": "now-36M/M","key":"36months"}, {"to": "now-24M/M","key":"2years_ago"}, {"from": "now-36M/M","to": "now-12M/M"} ], "keyed":true }, "aggs" : { "avg_price" : { "avg" : { "field" : "price" } } } } } } ----------Histogram Aggregation------- 直方图，按照20000为区间进行分桶 GET /cars/transactions/_search { "size" : 0, "aggs" : { "colors" : { "histogram" : { "field" : "price", "interval": 20000 } } } } min_doc_count参数，限制桶内至少有几个才显示 GET /cars/transactions/_search { "size" : 0, "aggs" : { "colors" : { "histogram" : { "field" : "price", "interval": 20000, "min_doc_count": 1 } } } } extended_bounds参数，扩展显示范围 GET /cars/transactions/_search { "size" : 0, "aggs" : { "colors" : { "histogram" : { "field" : "price", "interval": 20000, "extended_bounds": { "min" : 0, "max" : 200000 } } } } } 增加排序,按照桶名降序 GET /cars/transactions/_search { "size" : 0, "aggs" : { "colors" : { "histogram" : { "field" : "price", "interval": 20000, "order" : { "_key" : "desc" } } } } } 增加排序,按照统计数量排序 GET /cars/transactions/_search { "size" : 0, "aggs" : { "colors" : { "histogram" : { "field" : "price", "interval": 20000, "order" : { "_count" : "desc" } } } } } 直方图，按照20000为区间进行分桶，并进行汇总 GET /cars/transactions/_search { "size" : 0, "aggs":{ "price":{ "histogram":{ "field": "price", "interval": 20000 }, "aggs":{ "price_sum": { "sum": { "field" : "price" } } } } } } 直方图，按照20000为区间进行分桶，并进行汇总 按照子聚合的指标进行排序 GET /cars/transactions/_search { "size" : 0, "aggs":{ "price":{ "histogram":{ "field": "price", "interval": 20000, "order":{ "price_sum.value" : "desc" } }, "aggs":{ "price_sum": { "sum": { "field" : "price" } } } } } } 增加keyed参数 GET /cars/transactions/_search { "size" : 0, "aggs":{ "price":{ "histogram":{ "field": "price", "interval": 20000, "order":{ "price_sum.value" : "desc" } ,"keyed":true }, "aggs":{ "price_sum": { "sum": { "field" : "price" } } } } } } ----------Terms Aggregation------- 按照某个字段的词条进行分桶 在每个分片上先获取前几个数量最多的词条，然后再整体二次重排，所以可能会有误差 GET /cars/transactions/_search { "size": 0, "aggs" : { "make_terms" : { "terms" : { "field" : "make" } } } } 按照词条的字母顺序排序 GET /cars/transactions/_search { "size": 0, "aggs" : { "make_terms" : { "terms" : { "field" : "make", "order" : { "_term" : "asc" } } } } } min_doc_count：用于限制只提取出现次数大于多少次的词条 GET /cars/transactions/_search { "size": 0, "aggs" : { "make_terms" : { "terms" : { "field" : "make", "min_doc_count": 3 } } } } 使用脚本,进行修改field内容 GET /cars/transactions/_search { "size": 0, "aggs" : { "make_terms" : { "terms" : { "script" : { "inline": "'make:'+doc['make'].value", "lang": "painless" } } } } } 同上 GET /cars/transactions/_search { "size": 0, "aggs" : { "make_terms" : { "terms" : { "field" : "make", "script" : { "inline" : "'make: ' +_value", "lang" : "painless" } } } } } 使用正则表达式过滤词条 GET /cars/transactions/_search { "size": 0, "aggs" : { "make_terms" : { "terms" : { "field" : "make", "include" : ".*o.*", "exclude" : "f.*" } } } } 使用精确指定的词条进行分桶 GET /cars/transactions/_search { "size": 0, "aggs" : { "make_terms" : { "terms" : { "field" : "make", "include" : ["mazda", "honda"] } } } } ----------Range Aggregation------- 按照指定的范围区间分桶，并计算数量 GET /cars/transactions/_search { "size": 0, "aggs" : { "price_ranges" : { "range" : { "field" : "price", "ranges" : [ { "to" : 20000 }, { "from" : 20000, "to" : 50000 }, { "from" : 50000 } ] } } } } 用script脚本指定field GET /cars/transactions/_search { "size": 0, "aggs" : { "price_ranges" : { "range" : { "script" : { "lang": "painless", "inline": "doc['price'].value" }, "ranges" : [ { "to" : 20000 }, { "from" : 20000, "to" : 50000 }, { "from" : 50000 } ] } } } } 在分桶前，通过脚本更改值 GET /cars/transactions/_search { "size": 0, "aggs" : { "price_ranges" : { "range" : { "field" :"price", "script" : { "lang": "painless", "inline": "_value * params.rate", "params" : { "rate" : 2.5 } }, "ranges" : [ { "to" : 20000 }, { "from" : 20000, "to" : 50000 }, { "from" : 50000 } ] } } } } ----------Global Aggregation------- 用global来计算所有的文档 GET /cars/transactions/_search?size=0 { "query" : { "match" : { "make" : "honda" } }, "aggs" : { "all_makes" : { "global" : {}, "aggs" : { "avg_price" : { "avg" : { "field" : "price" } } } }, "honda_make": { "avg" : { "field" : "price" } } } } 验证一下global计算是否正确 GET /cars/transactions/_search?size=0 { "query" : { "match_all" : { } }, "aggs" : { "all_make": { "avg" : { "field" : "price" } } } } ----------IP Range Aggregation------- DELETE ips PUT ips { "mappings": { "transactions": { "properties": { "ip": { "type":"ip" } } } } } POST /ips/doc/_bulk { "index": {}} { "ip" : "192.168.1.1"} { "index": {}} { "ip" : "192.168.1.10"} { "index": {}} { "ip" : "192.168.1.102"} { "index": {}} { "ip" : "192.168.1.150"} { "index": {}} { "ip" : "192.168.1.160"} { "index": {}} { "ip" : "192.168.1.250"} 按照指定的ip范围分桶，并统计数量 GET /ips/doc/_search { "size": 0, "aggs" : { "ip_ranges" : { "ip_range" : { "field" : "ip", "ranges" : [ {"from" : "192.168.1.1" }, {"to" : "192.168.2.1" }, {"from" : "192.168.1.1","to" : "192.168.3.200" } ] } } } } 通过子网掩码范围分桶 192.168.1.0/24表示：192.168.1.1至192.168.1.254 192.168.2.0/25：192.168.2.1至192.168.2.126 GET /ips/doc/_search { "size": 0, "aggs" : { "ip_ranges" : { "ip_range" : { "field" : "ip", "ranges" : [ { "mask" : "192.168.1.0/24" }, { "mask" : "192.168.2.0/25" } ] } } } } 加入keyed参数 GET /ips/doc/_search { "size": 0, "aggs" : { "ip_ranges" : { "ip_range" : { "field" : "ip", "ranges" : [ { "mask" : "192.168.1.0/24" }, { "mask" : "192.168.2.0/25" } ], "keyed": true } } } } ----------Geo Distance Aggregation------- DELETE /museums PUT /museums { "mappings": { "doc": { "properties": { "location": { "type": "geo_point" } } } } } POST /museums/doc/_bulk?refresh {"index":{"_id":1}} {"location": "52.374081,4.912350", "name": "NEMO Science Museum"} {"index":{"_id":2}} {"location": "52.369219,4.901618", "name": "Museum Het Rembrandthuis"} {"index":{"_id":3}} {"location": "52.371667,4.914722", "name": "Nederlands Scheepvaartmuseum"} {"index":{"_id":4}} {"location": "51.222900,4.405200", "name": "Letterenhuis"} {"index":{"_id":5}} {"location": "48.861111,2.336389", "name": "Musée du Louvre"} {"index":{"_id":6}} {"location": "48.860000,2.327000", "name": "Musée d'Orsay"} 指定坐标点多少距离范围内的分桶文档，默认单位:m（米） POST /museums/_search?size=0 { "aggs" : { "rings_around_amsterdam" : { "geo_distance" : { "field" : "location", "origin" : "52.3760, 4.894", "ranges" : [ { "to" : 100000 }, { "from" : 100000, "to" : 300000 }, { "from" : 300000 } ] } } } } 指定单位为公里 可以使用：mi (miles英里), in (inches英寸), yd (yards码尺), km (kilometers), cm (centimeters), mm (millimeters). POST /museums/_search?size=0 { "aggs" : { "rings_around_amsterdam" : { "geo_distance" : { "field" : "location", "origin" : "52.3760, 4.894", "unit" : "km", "ranges" : [ { "to" : 100000 }, { "from" : 100000, "to" : 300000 }, { "from" : 300000 } ] } } } } 指定距离模式 distance_type：arc弧度（默认，精度高，计算准确），plane（性能更好，速度更快，但精度稍差） POST /museums/_search?size=0 { "aggs" : { "rings" : { "geo_distance" : { "field" : "location", "origin" : "52.3760, 4.894", "unit" : "km", "distance_type" : "plane", "ranges" : [ { "to" : 100 }, { "from" : 100, "to" : 300 }, { "from" : 300 } ] } } } } 使用keyed POST /museums/_search?size=0 { "aggs" : { "rings_around_amsterdam" : { "geo_distance" : { "field" : "location", "origin" : "52.3760, 4.894", "ranges" : [ { "to" : 100000 }, { "from" : 100000, "to" : 300000 }, { "from" : 300000 } ], "keyed": true } } } } 作者：壹点零 链接：https://www.jianshu.com/p/f79309adb63b 来源：简书 著作权归作者所有。商业转载请联系作者获得授权，非商业转载请注明出处。