对一个字段内的特定值进行弹性聚合

Question

我正在将我的数据库从 postgres 迁移到 elasticsearch。我的 postgres 查询如下所示：

select site_id, count(*) from r_2332 where site_id in ('1300','1364') and date >= '2021-01-25' and date <= '2021-01-30'

预期结果如下：

site_id   count
1300       1234
1364       2345

我正在尝试从 elasticsearch aggs 中得出相同的结果。我尝试了以下方法：

GET /r_2332/_search
{
   "query": {
    "bool" : {
      "should" : [
        {"match" : {"site_id": "1300"}},
        {"match" : {"site_id": "1364"}}
      ],"minimum_should_match": 1
    }
  },
    "aggs" : {
      "footfall" : {
        "range" : {
          "field" : "date",
          "ranges" : [
            {
              "from":"2021-01-21",
              "to":"2021-01-30"
            }
            ]
        }
      }
    }
}

这给了我如下结果：

"aggregations":{"footfall":{"buckets":[{"key":"2021-01-21T00:00:00.000Z-2021-01-30T00:00:00.000Z","from":1.6111872E12,"from_as_string":"2021-01-21T00:00:00.000Z","to":1.6119648E12,"to_as_string":"2021-01-30T00:00:00.000Z","doc_count":2679}]}

还有这个：

GET /r_2332/_search
{
   "query": {
    "terms": {
      "site_id": [ "1300", "1364" ],
      "boost": 1.0
    }
  },
    "aggs" : {
      "footfall" : {
        "range" : {
          "field" : "date",
          "ranges" : [
            {
              "from":"2021-01-21",
              "to":"2021-01-30"
            }
            ]
        }
      }
    }
}

这提供了相同的结果：

"aggregations":{"footfall":{"buckets":[{"key":"2021-01-21T00:00:00.000Z-2021-01-30T00:00:00.000Z","from":1.6111872E12,"from_as_string":"2021-01-21T00:00:00.000Z","to":1.6119648E12,"to_as_string":"2021-01-30T00:00:00.000Z","doc_count":2679}]}

如何分别获得每个 site_id 的结果？

Answer 1

您可以使用 terms and range aggregation 的组合来完成您的任务

添加带有索引数据、搜索查询和搜索结果的工作示例

索引数据：

{
    "site_id":1365,
    "date":"2021-01-24"
}
{
    "site_id":1300,
    "date":"2021-01-22"
}
{
    "site_id":1300,
    "date":"2020-01-22"
}
{
    "site_id":1364,
    "date":"2021-01-24"
}

搜索查询：

{
  "size": 0,
  "aggs": {
    "siteId": {
      "terms": {
        "field": "site_id",
        "include": [
          1300,
          1364
        ]
      },
      "aggs": {
        "footfall": {
          "range": {
            "field": "date",
            "ranges": [
              {
                "from": "2021-01-21",
                "to": "2021-01-30"
              }
            ]
          }
        }
      }
    }
  }
}

搜索结果：

"aggregations": {
    "siteId": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": 1300,
          "doc_count": 2,
          "footfall": {
            "buckets": [
              {
                "key": "2021-01-21T00:00:00.000Z-2021-01-30T00:00:00.000Z",
                "from": 1.6111872E12,
                "from_as_string": "2021-01-21T00:00:00.000Z",
                "to": 1.6119648E12,
                "to_as_string": "2021-01-30T00:00:00.000Z",
                "doc_count": 1                           // note this
              }
            ]
          }
        },
        {
          "key": 1364,
          "doc_count": 1,
          "footfall": {
            "buckets": [
              {
                "key": "2021-01-21T00:00:00.000Z-2021-01-30T00:00:00.000Z",
                "from": 1.6111872E12,
                "from_as_string": "2021-01-21T00:00:00.000Z",
                "to": 1.6119648E12,
                "to_as_string": "2021-01-30T00:00:00.000Z",
                "doc_count": 1                         // note this
              }
            ]
          }
        }
      ]
    }
  }

Answer 2

这可能会表现更好

{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "terms": {
            "site_id": [
              "1300",
              "1365"
            ]
          }
        },
        {
          "range": {
            "date": {
              "gte": "2021-01-21",
              "lte": "2021-01-24"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "group_by": {
      "terms": {
        "field": "site_id"
      }
    }
  }
}

对一个字段内的特定值进行弹性聚合

Elastic aggregation on specific values from within one field

aggregation

elasticsearch