Elasticsearch 求和桶

Question

我有以下请求，它将 return 状态为 "Accepted"、"Released" 或已关闭的所有文档的数量。

{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "*",
            "analyze_wildcard": true
          }
        }
      ],
      "must_not": []
    }
  },
  "aggs": {
    "slices": {
      "terms": {
        "field": "status.raw",
        "include": {
          "pattern": "Accepted|Released|Closed"
        }
      }
    }
  }
}

在我的例子中，响应是：

 "buckets": [
        {
          "key": "Closed",
          "doc_count": 2216
        },
        {
          "key": "Accepted",
          "doc_count": 8
        },
        {
          "key": "Released",
          "doc_count": 6
        }
      ]

现在我想将它们全部添加到一个字段中。我尝试使用管道聚合，甚至尝试了以下 sum_bucket（显然只适用于多桶）：

"total":{
    "sum_bucket":{
        "buckets_path": "slices"
    }
}

有人能帮我解决这个问题吗？

Answer 1

我要做的是改用 filters aggregation 并定义您需要的所有存储桶，如下所示：

{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "*",
            "analyze_wildcard": true
          }
        }
      ],
      "must_not": []
    }
  },
  "aggs": {
    "slices": {
      "filters": {
        "filters": {
          "accepted": {
            "term": {
              "status.raw": "Accepted"
            }
          },
          "released": {
            "term": {
              "status.raw": "Released"
            }
          },
          "closed": {
            "term": {
              "status.raw": "Closed"
            }
          },
          "total": {
            "terms": {
              "status.raw": [
                "Accepted",
                "Released",
                "Closed"
              ]
            }
          }
        }
      }
    }
  }
}

Answer 2

使用 sum_bucket 和您已经存在的聚合：

  "aggs": {
    "slices": {
      "terms": {
        "field": "status.raw",
        "include": {
          "pattern": "Accepted|Released|Closed"
        }
      }
    },
    "sum_total": {
      "sum_bucket": {
        "buckets_path": "slices._count"
      }
    }
  }

Answer 3

您可以使用 value_count sub aggregation and then use sum_bucket pipeline aggregation

添加计数

{
  "aggs": {
    "unique_status": {
      "terms": {
        "field": "status.raw",
        "include": "Accepted|Released|Closed"
      },
      "aggs": {
        "count": {
          "value_count": {
            "field": "status.raw"
          }
        }
      }
    },
    "sum_status": {
      "sum_bucket": {
        "buckets_path": "unique_status>count"
      }
    }
  },
  "size": 0
}

Elasticsearch 求和桶

Elasticsearch summing buckets

buckets

elasticsearch