环境:ElasticSearch6.7
需求:对多个字段进行聚合,并在聚合后对某个字段在进行求和,类似于SQL中的:
select sum(求和字段) as sumValue from table where ... group by 字段1,字段2,字段3 order by sumValue desc,count(*) desc;
ElasticSearch的Restful API实现(方式一):
GET /ads_united_standard_analysis_im_exporter/_search
{
"query": {
},
"size": 0,
"aggs": {
"别名1": {
"terms": {
"field": "字段1"
},
"aggs": {
"别名2": {
"terms": {
"field": "字段2"
},
"aggs": {
"别名3": {
"terms": {
"field": "字段2",
"order":{
"求和字段别名": "desc",
"_key": "desc"
}
},
"aggs": {
"求和字段别名": {
"sum": {
"field": "求和字段"
}
}
}
}
}
}
}
}
}
}
ElasticSearch的Restful API实现(方式二、script格式实现):
GET /ads_united_standard_analysis_im_exporter/_search
{
"query": {},
"size": 0,
"aggs": {
"reporter": {
"terms": {
"script": "doc['reporter']+'###'+doc['hscode']+'###'+doc['export_country']",
"order": {
"exp_total_value": "desc",
"_count": "desc"
}
},
"aggs": {
"exp_total_value": {
"sum": {
"field": "now_total_value"
}
}
}
}
}
}