elasticsearch min和max在其他聚合结果上的合并

我试图在elasticsearch中查找聚合结果的最小值和最大值。什么查询将允许它先通过字段进行汇总，然后执行月度子汇总以获取该字段的月度数据，然后在那些每月计算的度量标准中查找最小值和最大值。 我被困在发现min和max。对于以下要求的其余部分是我的查询elasticsearch min和max在其他聚合结果上的合并

这个问题可以表述为：什么是在任何国家的最大和最小交易（考虑所有月份）？ 这里，我试图查询：

{ 
    "query": { 
    "bool": { 
     "must": [ 
     { 
      "term": { 
      "Id": "7466swy7893jgs225" 
      } 
     } 
     ] 
    } 
    }, 
    "aggs": { 
    "dimension": { 
     "terms": { 
     "field": "country" 
     }, 
     "aggs": { 
     "MoM": { 
      "date_histogram": { 
      "field": "date", 
      "interval": "month", 
      "format": "MMM YY" 
      }, 
      "aggs": { 
      "totalValue": { 
       "sum": { 
       "field": "Transactions" 
       } 
      } 
      } 
     } 
     } 
    } 
    }, 
    "size": 0

}

这是我得到的输出：

{ 
    "aggregations": { 
    "dimension": { 
    "doc_count_error_upper_bound": 0, 
    "sum_other_doc_count": 0, 
    "buckets": [ 
    { 
     "key": "USA", 
     "doc_count": 392, 
     "MoM": { 
      "buckets": [ 
      { 
      "key_as_string": "jan 16", 
      "key": 1462060800000, 
      "doc_count": 31, 
      "totalValue": { "value": 352 } 
      }, 
      { 
      "key_as_string": "Feb 16", 
      "key": 1462060800000, 
      "doc_count": 31, 
      "totalValue": { "value": 429 } 
      } 
     ??????????????/MIN and MAX of 352 AND 429 
      ] 
     } 
    }, 
    { 
     "key": "Bhutan", 
     "doc_count": 392, 
     "MoM": { 
      "buckets": [ 
      { 
      "key_as_string": "Jan 16", 
      "key": 1462060800000, 
      "doc_count": 31, 
      "totalValue": {"value": 750 } 
      } 
      , 
      { 
      "key_as_string": "Feb 16", 
      "key": 1464739200000, 
      "doc_count": 30, 
      "totalValue": {"value": 827 } 
     } 
      ??????????????/MIN and MAX of 750 AND 827 

     ] 
    } 
    } 
] 
} 
}}

来源

2017-05-29 anekix

您需要使用Pipeline Aggregation.。尝试Max Bucket和Min Bucket聚集

{ 
"size": 0, 
"aggs": { 
    "dimension": { 
    "terms": { 
     "field": "country" 
    }, 
    "aggs": { 
     "MoM": { 
      "date_histogram": { 
       "field": "date", 
       "interval": "month", 
       "format": "MMM YY" 
      }, 
      "aggs": { 
       "totalValue": { 
       "sum": { 
        "field": "transactions" 
       } 
       } 
      } 
     }, 
     "max_monthly_temp": { 
      "max_bucket": { 
       "buckets_path": "MoM>totalValue" 
      } 
     }, 
     "min_monthly_temp": { 
      "min_bucket": { 
       "buckets_path": "MoM>totalValue" 
       } 
      } 
     } 
     } 
    } 
}

输出会有点像：

"buckets": [ 
     { 
      "key": "India", 
      "doc_count": 5, 
      "MoM": { 
       "buckets": [ 
       { 
        "key_as_string": "Feb 17", 
        "key": 1485907200000, 
        "doc_count": 3, 
        "totalValue": { 
         "value": 260 
        } 
       }, 
       { 
        "key_as_string": "Mar 17", 
        "key": 1488326400000, 
        "doc_count": 1, 
        "totalValue": { 
         "value": 115 
        } 
       }, 
       { 
        "key_as_string": "Apr 17", 
        "key": 1491004800000, 
        "doc_count": 1, 
        "totalValue": { 
         "value": 5 
        } 
       } 
       ] 
      }, 
      "max_monthly_temp": { 
       "value": 260, 
       "keys": [ 
       "Feb 17" 
       ] 
      }, 
      "min_monthly_temp": { 
       "value": 5, 
       "keys": [ 
       "Apr 17" 
       ] 
      } 
     }, 
    ...... 
     ]

希望这有助于..

来源

2017-05-29 15:54:39 Richa

i一定会尝试一下。我看起来很有道理。谢谢！ – anekix

乐于帮忙.. – Richa

尝试用下面的查询。在aggs字段中添加最小和最大度量标准。

{ 
    "query": { 
    "bool": { 
     "must": [ 
     { 
      "term": { 
      "Id": "7466swy7893jgs225" 
      } 
     } 
     ] 
    } 
    }, 
    "aggs": { 
    "dimension": { 
     "terms": { 
     "field": "country" 
     }, 
     "aggs": { 
     "MoM": { 
      "date_histogram": { 
      "field": "date", 
      "interval": "month", 
      "format": "MMM YY" 
      }, 
      "aggs": { 
      "totalValue": { 
       "sum": { 
       "field": "Transactions" 
       } 
      }, 
      "min":{ 
       "min":{ 
       "field":"Transactions" 
       } 
      }, 
      "max":{ 
       "max":{ 
       "field":"Transactions" 
       } 
      } 
      } 
     } 
     } 
    } 
    }, 
    "size": 0 
}

来源

2017-05-29 09:02:37

时，我想找到的最小和最大的交易场该查询工作。但我的问题是发现MoM聚合的最小和最大值（这给了一个月的桶，如上面我当前的输出所示）。它可以被重新设置为任何国家的最大和最小交易（考虑所有月份） – anekix

elasticsearch min和max在其他聚合结果上的合并

回答

相关问题