elasticsearch多个字段分组查询

Elasticsearch：多字段分组与聚合查询

最新推荐文章于 2024-08-16 11:00:41 发布

原创最新推荐文章于 2024-08-16 11:00:41 发布 · 3.9k 阅读

4 ·

CC 4.0 BY-SA版权

文章标签：

#elasticsearch

本文介绍了如何在Elasticsearch中使用聚合功能进行多字段分组查询，特别是结合日期类型转换和字符串截取的方法。通过示例展示了如何在`aggs`下配置`terms`和`top_hits`，实现日期、国家、城市等多个字段的分组，并限制每个桶的最小文档计数，同时获取每个分组的最相关文档。

GET /work_order_olap/_search
{
  "size": 0,
  "aggs": {
    "group_by_field": {
      "terms": {
        "size": 2,
        "script": "doc['material_no'] +'####'+doc['material_name']+'####'+doc['material_category']"
      }
      ,"aggs":{
        "total_material_cost":{
          "sum": {
            "field": "total_material_cost"
          }
        }
      }
    }
   
  }
}

方法2

GET /work_order_olap/_search
{
  "size": 0,
  "aggs": {
    "group_by_field": {
      "composite": {
        "size": 1200,
        "sources": [
          {
            "material_no": {
              "terms": {
                "field": "material_no"
              }
            }
          }
          , {
            "material_name": {
              "terms": {
                "field": "material_name"
              }
            }
          }
          , {
            "material_category": {
              "terms": {
                "field": "material_category"
              }
            }
          }
        ]
      }
      ,"aggs":{
        "total_material_cost":{
          "sum": {
            "field": "material_quantity"
          }
        }
      }
    }
   
  }
}

日期类型tostring 和字符串截取

"aggs": {
"NAME": {
"terms": {
"script": "(doc.pubdate.value+'').substring(0,10)+'####'+doc.country.value +'####'+doc.city.value+'####'+doc.death_toll.value+'####'+doc.injured_toll.value+'####'",
"min_doc_count": 2,
"size": 100
}
, "aggs": {
"NAME": {
"top_hits": {
"from": 0,
"size": 100,
"_source": ["_id","time"],
"sort": ["pubdate"]
}
}
}
}
}