ElasticSearch6.x版本聚合分析整理
ES將聚合分析主要分為如下4類
- Bucket,分桶類型,類似SQL中的GROUP BY語法
- Metric,指標分析類型,如計算最大值 , 最小值,平均值等
- Pipeline,管道分析類型,基於上一級的聚合分析結果進行再分析
- Matrix,矩陣分析類型
Metric聚合分析
主要分如下兩類:
1.單值分析,只輸出一個分析結果
min,max,avg,sum
cardinality
2.多值分析,輸出多個分析結果
stats,extended stats
percentile,percentile rank
top hits
需要使用到的數據:
POST test_search_index/doc/_bulk
{"index":{"_id":"1"}}
{"username":"alfred way","job":"java engineer","age":18,"birth":"1990-01-02","isMarried":false,"salary":10000}
{"index":{"_id":"2"}}
{"username":"tom","job":"java senior engineer","age":28,"birth":"1980-05-07","isMarried":true,"salary":30000}
{"index":{"_id":"3"}}
{"username":"lee","job":"ruby engineer","age":22,"birth":"1985-08-07","isMarried":false,"salary":15000}
{"index":{"_id":"4"}}
{"username":"Nick","job":"web engineer","age":23,"birth":"1989-08-07","isMarried":false,"salary":8000}
{"index":{"_id":"5"}}
{"username":"Niko","job":"web engineer","age":18,"birth":"1994-08-07","isMarried":false,"salary":5000}
{"index":{"_id":"6"}}
{"username":"Michell","job":"ruby engineer","age":26,"birth":"1987-08-07","isMarried":false,"salary":12000}
Metric聚合分析
返回數值類字段的平均值
GET test_search_index/_search
{
#不需要返回文檔列表
"size":0,
"aggs":{
#名字
"min_age":{
#關鍵詞
"min":{
"field":"age"
}
}
}
}
#返回結果:
{
"took": 5,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"min_age": {
"value": 18
}
}
}
#返回數值類字段的最大值
GET test_search_index/_search
{
"size":0,
"aggs":{
"max_age":{
"max":{
"field":"age"
}
}
}
}
#返回結果
{
"took": 7,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"max_age": {
"value": 28
}
}
}
#返回數值類字段的平均值
GET test_search_index/_search
{
"size":0,
"aggs":{
"avg_age":{
"avg":{
"field":"age"
}
}
}
}
#返回結果
{
"took": 2,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"avg_age": {
"value": 22.5
}
}
}
#返回數值字段的總和
GET test_search_index/_search
{
"size":0,
"aggs":{
"sum_age":{
"sum":{
"field":"age"
}
}
}
}
{
"took": 3,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"sum_age": {
"value": 135
}
}
}
#一次返回多個結果
{
"size":0,
"aggs":{
"min_age":{
"min":{
"field":"age"
}
},
"max_age":{
"max":{
"field":"age"
}
},
"sum_age":{
"sum":{
"field":"age"
}
}
}
}
#返回結果
{
"took": 2,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"max_age": {
"value": 28
},
"sum_age": {
"value": 135
},
"min_age": {
"value": 18
}
}
}
Metric聚合分析--Cardinality
Cardinality,意為集合的勢,或者基數,是指不同數值的個數,類似SQL中的distinct count概念
GET test_search_index/_search
{
"size":10,
"aggs":{
"count_of_job":{
"cardinality":{
"field":"job.keyword"
}
}
}
}
#返回
{
"took": 4,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 1,
"hits": [
{
"_index": "test_search_index",
"_type": "doc",
"_id": "5",
"_score": 1,
"_source": {
"username": "Niko",
"job": "web engineer",
"age": 18,
"birth": "1994-08-07",
"isMarried": false,
"salary": 5000
}
},
{
"_index": "test_search_index",
"_type": "doc",
"_id": "2",
"_score": 1,
"_source": {
"username": "tom",
"job": "java senior engineer",
"age": 28,
"birth": "1980-05-07",
"isMarried": true,
"salary": 30000
}
},
{
"_index": "test_search_index",
"_type": "doc",
"_id": "4",
"_score": 1,
"_source": {
"username": "Nick",
"job": "web engineer",
"age": 23,
"birth": "1989-08-07",
"isMarried": false,
"salary": 8000
}
},
{
"_index": "test_search_index",
"_type": "doc",
"_id": "6",
"_score": 1,
"_source": {
"username": "Michell",
"job": "ruby engineer",
"age": 26,
"birth": "1987-08-07",
"isMarried": false,
"salary": 12000
}
},
{
"_index": "test_search_index",
"_type": "doc",
"_id": "1",
"_score": 1,
"_source": {
"username": "alfred way",
"job": "java engineer",
"age": 18,
"birth": "1990-01-02",
"isMarried": false,
"salary": 10000
}
},
{
"_index": "test_search_index",
"_type": "doc",
"_id": "3",
"_score": 1,
"_source": {
"username": "lee",
"job": "ruby engineer",
"age": 22,
"birth": "1985-08-07",
"isMarried": false,
"salary": 15000
}
}
]
},
"aggregations": {
"count_of_job": {
"value": 4
}
}
}
Metric聚合分析-Stats
返回一系列數值類型的統計值,包含min,max,avg,sum和count
GET test_search_index/_search
{
"size":0,
"aggs":{
"stats_age":{
"stats":{
"field":"age"
}
}
}
}
#返回
{
"took": 1,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"stats_age": {
"count": 6,
"min": 18,
"max": 28,
"avg": 22.5,
"sum": 135
}
}
}
Metric聚合分析-Extended Stats
對stats的擴展,包含了更多的統計數據,如方差,標准差等
GET test_search_index/_search
{
"size":0,
"aggs":{
"stats_age":{
"extended_stats":{
"field":"age"
}
}
}
}
#返回
{
"took": 2,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"stats_age": {
"count": 6,
"min": 18,
"max": 28,
"avg": 22.5,
"sum": 135,
"sum_of_squares": 3121,
"variance": 13.916666666666666,
"std_deviation": 3.730504880933232,
"std_deviation_bounds": {
"upper": 29.961009761866464,
"lower": 15.038990238133536
}
}
}
}
Metric聚合分析-Percentile
百分位數統計
GET test_search_index/_search
{
"size":0,
"aggs":{
"per_age":{
"percentiles":{
"field":"salary"
}
}
}
}
#返回
{
"took": 6,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"per_age": {
#代表有百分之一的人工資在5000以下,百分之二十五的人工資在8000以下....
"values": {
"1.0": 5000,
"5.0": 5000,
"25.0": 8000,
"50.0": 11000,
"75.0": 15000,
"95.0": 30000,
"99.0": 30000
}
}
}
}
GET test_search_index/_search
{
"size":0,
"aggs":{
"per_age":{
"percentile_ranks":{
"field":"salary",
"values":[
11000,
30000
]
}
}
}
}
#返回
{
"took": 2,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"per_age": {
"values": {
"11000.0": 50,
"30000.0": 100
}
}
}
}
Metric聚合分析-Top Hits
一般用於分桶后獲取該桶內最匹配的頂部文檔列表,即詳情數據
#先按照job分桶, 然后在桶內做年齡的排序
GET test_search_index/_search
{
"size":0,
"aggs":{
"jobs":{
"terms":{
"field":"job.keyword",
"size":10
},
"aggs":{
"top_employee":{
"top_hits":{
"size":10,
"sort":[
{
"age":{
"order":"desc"
}
}
]
}
}
}
}
}
}
#返回
{
"took": 42,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"jobs": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "ruby engineer",
"doc_count": 2,
"top_employee": {
"hits": {
"total": 2,
"max_score": null,
"hits": [
{
"_index": "test_search_index",
"_type": "doc",
"_id": "6",
"_score": null,
"_source": {
"username": "Michell",
"job": "ruby engineer",
"age": 26,
"birth": "1987-08-07",
"isMarried": false,
"salary": 12000
},
"sort": [
26
]
},
{
"_index": "test_search_index",
"_type": "doc",
"_id": "3",
"_score": null,
"_source": {
"username": "lee",
"job": "ruby engineer",
"age": 22,
"birth": "1985-08-07",
"isMarried": false,
"salary": 15000
},
"sort": [
22
]
}
]
}
}
},
{
"key": "web engineer",
"doc_count": 2,
"top_employee": {
"hits": {
"total": 2,
"max_score": null,
"hits": [
{
"_index": "test_search_index",
"_type": "doc",
"_id": "4",
"_score": null,
"_source": {
"username": "Nick",
"job": "web engineer",
"age": 23,
"birth": "1989-08-07",
"isMarried": false,
"salary": 8000
},
"sort": [
23
]
},
{
"_index": "test_search_index",
"_type": "doc",
"_id": "5",
"_score": null,
"_source": {
"username": "Niko",
"job": "web engineer",
"age": 18,
"birth": "1994-08-07",
"isMarried": false,
"salary": 5000
},
"sort": [
18
]
}
]
}
}
},
{
"key": "java engineer",
"doc_count": 1,
"top_employee": {
"hits": {
"total": 1,
"max_score": null,
"hits": [
{
"_index": "test_search_index",
"_type": "doc",
"_id": "1",
"_score": null,
"_source": {
"username": "alfred way",
"job": "java engineer",
"age": 18,
"birth": "1990-01-02",
"isMarried": false,
"salary": 10000
},
"sort": [
18
]
}
]
}
}
},
{
"key": "java senior engineer",
"doc_count": 1,
"top_employee": {
"hits": {
"total": 1,
"max_score": null,
"hits": [
{
"_index": "test_search_index",
"_type": "doc",
"_id": "2",
"_score": null,
"_source": {
"username": "tom",
"job": "java senior engineer",
"age": 28,
"birth": "1980-05-07",
"isMarried": true,
"salary": 30000
},
"sort": [
28
]
}
]
}
}
}
]
}
}
}
Bucket聚合分析
Terms
該分桶策略最簡單,直接按照term來分桶,如果是text類型,則按照分次后的結果分桶
GET test_search_index/_search
{
"size":0,
"aggs":{
"jobs":{
"terms":{
"field":"job.keyword",
"size":10
}
}
}
}
#返回
{
"took": 2,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"jobs": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "ruby engineer",
"doc_count": 2
},
{
"key": "web engineer",
"doc_count": 2
},
{
"key": "java engineer",
"doc_count": 1
},
{
"key": "java senior engineer",
"doc_count": 1
}
]
}
}
}
Range
通過制定數值的范圍來設定分桶規則
GET test_search_index/_search
{
"size":0,
"aggs":{
"salary_range":{
"range":{
"field":"salary",
"ranges":[
{
"to":10000
},
{
"from":10000,
"to":20000
},
{
"from":20000
}
]
}
}
}
}
#返回
{
"took": 3,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"salary_range": {
"buckets": [
{
"key": "*-10000.0",
"to": 10000,
"doc_count": 2
},
{
"key": "10000.0-20000.0",
"from": 10000,
"to": 20000,
"doc_count": 3
},
{
"key": "20000.0-*",
"from": 20000,
"doc_count": 1
}
]
}
}
}
Date Range
通過制定日期的范圍來設定分桶規則
GET test_search_index/_search
{
"size":0,
"aggs":{
"date_range":{
"range":{
"field":"birth",
"format":"yyyy",
"ranges":[
{
"from":"1980",
"to":"1990"
},
{
"from":"1990",
"to":"2000"
},
{
"from":"2000"
}
]
}
}
}
}
#返回
{
"took": 3,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"date_range": {
"buckets": [
{
"key": "1980-1990",
"from": 315532800000,
"from_as_string": "1980",
"to": 631152000000,
"to_as_string": "1990",
"doc_count": 4
},
{
"key": "1990-2000",
"from": 631152000000,
"from_as_string": "1990",
"to": 946684800000,
"to_as_string": "2000",
"doc_count": 2
},
{
"key": "2000-*",
"from": 946684800000,
"from_as_string": "2000",
"doc_count": 0
}
]
}
}
}
Historgram
直方圖,以固定間隔的策略來分隔數據
#表示間隔5000分隔工資的分布情況, 最小0,最大40000
GET test_search_index/_search
{
"size":0,
"aggs":{
"salary_hist":{
"histogram":{
"field":"salary",
"interval":5000,
"extended_bounds":{
"min":0,
"max":40000
}
}
}
}
}
#返回
{
"took": 2,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"salary_hist": {
"buckets": [
{
"key": 0,
"doc_count": 0
},
{
"key": 5000,
"doc_count": 2
},
{
"key": 10000,
"doc_count": 2
},
{
"key": 15000,
"doc_count": 1
},
{
"key": 20000,
"doc_count": 0
},
{
"key": 25000,
"doc_count": 0
},
{
"key": 30000,
"doc_count": 1
},
{
"key": 35000,
"doc_count": 0
},
{
"key": 40000,
"doc_count": 0
}
]
}
}
}
Date Historgram
針對日期的直方圖或者柱狀圖,是時序數據分析中常用的聚合分析類型
GET test_search_index/_search
{
"size":0,
"aggs":{
"salary_hist":{
"date_histogram":{
"field":"birth",
"interval":"year",
"format":"yyyy"
}
}
}
}
#返回
{
"took": 4,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"salary_hist": {
"buckets": [
{
"key_as_string": "1980",
"key": 315532800000,
"doc_count": 1
},
{
"key_as_string": "1981",
"key": 347155200000,
"doc_count": 0
},
{
"key_as_string": "1982",
"key": 378691200000,
"doc_count": 0
},
{
"key_as_string": "1983",
"key": 410227200000,
"doc_count": 0
},
{
"key_as_string": "1984",
"key": 441763200000,
"doc_count": 0
},
{
"key_as_string": "1985",
"key": 473385600000,
"doc_count": 1
},
{
"key_as_string": "1986",
"key": 504921600000,
"doc_count": 0
},
{
"key_as_string": "1987",
"key": 536457600000,
"doc_count": 1
},
{
"key_as_string": "1988",
"key": 567993600000,
"doc_count": 0
},
{
"key_as_string": "1989",
"key": 599616000000,
"doc_count": 1
},
{
"key_as_string": "1990",
"key": 631152000000,
"doc_count": 1
},
{
"key_as_string": "1991",
"key": 662688000000,
"doc_count": 0
},
{
"key_as_string": "1992",
"key": 694224000000,
"doc_count": 0
},
{
"key_as_string": "1993",
"key": 725846400000,
"doc_count": 0
},
{
"key_as_string": "1994",
"key": 757382400000,
"doc_count": 1
}
]
}
}
}
Bucket+Metric聚合分析
分桶后再分桶
1. GET test_search_index/_search
{
"size":0,
"aggs":{
"jobs":{
"terms":{
"field":"job.keyword",
"size":10
},
"aggs":{
"age_range":{
"range":{
"field":"age",
"ranges":[
{"to":20},
{"from":20,"to":30},
{"from":30}
]
}
}
}
}
}
}
#返回
{
"took": 2,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"jobs": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "ruby engineer",
"doc_count": 2,
"age_range": {
"buckets": [
{
"key": "*-20.0",
"to": 20,
"doc_count": 0
},
{
"key": "20.0-30.0",
"from": 20,
"to": 30,
"doc_count": 2
},
{
"key": "30.0-*",
"from": 30,
"doc_count": 0
}
]
}
},
{
"key": "web engineer",
"doc_count": 2,
"age_range": {
"buckets": [
{
"key": "*-20.0",
"to": 20,
"doc_count": 1
},
{
"key": "20.0-30.0",
"from": 20,
"to": 30,
"doc_count": 1
},
{
"key": "30.0-*",
"from": 30,
"doc_count": 0
}
]
}
},
{
"key": "java engineer",
"doc_count": 1,
"age_range": {
"buckets": [
{
"key": "*-20.0",
"to": 20,
"doc_count": 1
},
{
"key": "20.0-30.0",
"from": 20,
"to": 30,
"doc_count": 0
},
{
"key": "30.0-*",
"from": 30,
"doc_count": 0
}
]
}
},
{
"key": "java senior engineer",
"doc_count": 1,
"age_range": {
"buckets": [
{
"key": "*-20.0",
"to": 20,
"doc_count": 0
},
{
"key": "20.0-30.0",
"from": 20,
"to": 30,
"doc_count": 1
},
{
"key": "30.0-*",
"from": 30,
"doc_count": 0
}
]
}
}
]
}
}
}
2.分桶后進行數據分析
GET test_search_index/_search
{
"size":0,
"aggs":{
"jobs":{
"terms":{
"field":"job.keyword",
"size":10
},
"aggs":{
"salary":{
"stats":{
"field":"salary"
}
}
}
}
}
}
{
"took": 7,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"jobs": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "ruby engineer",
"doc_count": 2,
"salary": {
"count": 2,
"min": 12000,
"max": 15000,
"avg": 13500,
"sum": 27000
}
},
{
"key": "web engineer",
"doc_count": 2,
"salary": {
"count": 2,
"min": 5000,
"max": 8000,
"avg": 6500,
"sum": 13000
}
},
{
"key": "java engineer",
"doc_count": 1,
"salary": {
"count": 1,
"min": 10000,
"max": 10000,
"avg": 10000,
"sum": 10000
}
},
{
"key": "java senior engineer",
"doc_count": 1,
"salary": {
"count": 1,
"min": 30000,
"max": 30000,
"avg": 30000,
"sum": 30000
}
}
]
}
}
}
Pipeline聚合分析
針對聚合分析的結果再次進行聚合分析,而且支持鏈式調用
Pipeline的分析結果會輸出到原結果中,根據輸出位置的不同,分為以下兩類:
1.Parent結果內嵌到現有的聚合分析結果中
Derivative
Moving Average
Cumulative Sum
2.Sibling結果與現有聚合分析結果同級
Max/Min/Avg/Sum Bucket
Stats/Extended Stats Bucket
Percentitles Bucket
Sibling - Min Bucket
找出所有Bucket中值最小的Bucket名稱和值
1.聚合分析求job的和
2.job里面內嵌套了一個求平均salary
3.然后用一個同級的 Min Bucket求上面平均工資里面最小的那個
GET test_search_index/_search
{
"size":0,
"aggs":{
"jobs":{
"terms":{
"field":"job.keyword",
"size":10
},
"aggs":{
"avg_salary":{
"avg":{
"field":"salary"
}
}
}
},
"min_salary_by_job":{
"min_bucket":{
"buckets_path":"jobs>avg_salary"
}
}
}
}
{
"took": 5,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"jobs": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "ruby engineer",
"doc_count": 2,
"avg_salary": {
"value": 13500
}
},
{
"key": "web engineer",
"doc_count": 2,
"avg_salary": {
"value": 6500
}
},
{
"key": "java engineer",
"doc_count": 1,
"avg_salary": {
"value": 10000
}
},
{
"key": "java senior engineer",
"doc_count": 1,
"avg_salary": {
"value": 30000
}
}
]
},
"min_salary_by_job": {
"value": 6500,
"keys": [
"web engineer"
]
}
}
}
找出所有Bucket中值最大的Bucket名稱和值
GET test_search_index/_search
{
"size":0,
"aggs":{
"jobs":{
"terms":{
"field":"job.keyword",
"size":10
},
"aggs":{
"avg_salary":{
"avg":{
"field":"salary"
}
}
}
},
"max_salary_by_job":{
"max_bucket":{
"buckets_path":"jobs>avg_salary"
}
}
}
}
找出所有Bucket中值平均值
GET test_search_index/_search
{
"size":0,
"aggs":{
"jobs":{
"terms":{
"field":"job.keyword",
"size":10
},
"aggs":{
"avg_salary":{
"avg":{
"field":"salary"
}
}
}
},
"avg_salary_by_job":{
"avg_bucket":{
"buckets_path":"jobs>avg_salary"
}
}
}
}
計算所有Bucket值的Stats分析
GET test_search_index/_search
{
"size":0,
"aggs":{
"jobs":{
"terms":{
"field":"job.keyword",
"size":10
},
"aggs":{
"avg_salary":{
"avg":{
"field":"salary"
}
}
}
},
"stats_salary_by_job":{
"stats_bucket":{
"buckets_path":"jobs>avg_salary"
}
}
}
}
#返回
{
"took": 3,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"jobs": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "ruby engineer",
"doc_count": 2,
"avg_salary": {
"value": 13500
}
},
{
"key": "web engineer",
"doc_count": 2,
"avg_salary": {
"value": 6500
}
},
{
"key": "java engineer",
"doc_count": 1,
"avg_salary": {
"value": 10000
}
},
{
"key": "java senior engineer",
"doc_count": 1,
"avg_salary": {
"value": 30000
}
}
]
},
"stats_salary_by_job": {
"count": 4,
"min": 6500,
"max": 30000,
"avg": 15000,
"sum": 60000
}
}
}
計算所有Bucket值的百分位數
GET test_search_index/_search
{
"size":0,
"aggs":{
"jobs":{
"terms":{
"field":"job.keyword",
"size":10
},
"aggs":{
"avg_salary":{
"avg":{
"field":"salary"
}
}
}
},
"percentiles_salary_by_job":{
"percentiles_bucket":{
"buckets_path":"jobs>avg_salary"
}
}
}
}
{
"took": 1,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"jobs": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "ruby engineer",
"doc_count": 2,
"avg_salary": {
"value": 13500
}
},
{
"key": "web engineer",
"doc_count": 2,
"avg_salary": {
"value": 6500
}
},
{
"key": "java engineer",
"doc_count": 1,
"avg_salary": {
"value": 10000
}
},
{
"key": "java senior engineer",
"doc_count": 1,
"avg_salary": {
"value": 30000
}
}
]
},
"percentiles_salary_by_job": {
"values": {
"1.0": 6500,
"5.0": 6500,
"25.0": 10000,
"50.0": 13500,
"75.0": 13500,
"95.0": 30000,
"99.0": 30000
}
}
}
}
Parent- Derivative
計算Bucket值的導數
GET test_search_index/_search
{
"size":0,
"aggs":{
"birth":{
"date_histogram":{
"field":"birth",
"interval":"year",
"min_doc_count":0
},
"aggs":{
"avg_salary":{
"avg":{
"field":"salary"
}
},
"derivative_avg_salary":{
"derivative":{
"buckets_path":"avg_salary"
}
}
}
}
}
}
#返回
{
"took": 2,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 6,
"max_score": 0,
"hits": []
},
"aggregations": {
"birth": {
"buckets": [
{
"key_as_string": "1980-01-01T00:00:00.000Z",
"key": 315532800000,
"doc_count": 1,
"avg_salary": {
"value": 30000
}
},
{
"key_as_string": "1981-01-01T00:00:00.000Z",
"key": 347155200000,
"doc_count": 0,
"avg_salary": {
"value": null
},
"derivative_avg_salary": {
"value": null
}
},
{
"key_as_string": "1982-01-01T00:00:00.000Z",
"key": 378691200000,
"doc_count": 0,
"avg_salary": {
"value": null
},
"derivative_avg_salary": {
"value": null
}
},
{
"key_as_string": "1983-01-01T00:00:00.000Z",
"key": 410227200000,
"doc_count": 0,
"avg_salary": {
"value": null
},
"derivative_avg_salary": {
"value": null
}
},
{
"key_as_string": "1984-01-01T00:00:00.000Z",
"key": 441763200000,
"doc_count": 0,
"avg_salary": {
"value": null
},
"derivative_avg_salary": {
"value": null
}
},
{
"key_as_string": "1985-01-01T00:00:00.000Z",
"key": 473385600000,
"doc_count": 1,
"avg_salary": {
"value": 15000
},
"derivative_avg_salary": {
"value": null
}
},
{
"key_as_string": "1986-01-01T00:00:00.000Z",
"key": 504921600000,
"doc_count": 0,
"avg_salary": {
"value": null
},
"derivative_avg_salary": {
"value": null
}
},
{
"key_as_string": "1987-01-01T00:00:00.000Z",
"key": 536457600000,
"doc_count": 1,
"avg_salary": {
"value": 12000
},
"derivative_avg_salary": {
"value": null
}
},
{
"key_as_string": "1988-01-01T00:00:00.000Z",
"key": 567993600000,
"doc_count": 0,
"avg_salary": {
"value": null
},
"derivative_avg_salary": {
"value": null
}
},
{
"key_as_string": "1989-01-01T00:00:00.000Z",
"key": 599616000000,
"doc_count": 1,
"avg_salary": {
"value": 8000
},
"derivative_avg_salary": {
"value": null
}
},
{
"key_as_string": "1990-01-01T00:00:00.000Z",
"key": 631152000000,
"doc_count": 1,
"avg_salary": {
"value": 10000
},
"derivative_avg_salary": {
"value": 2000
}
},
{
"key_as_string": "1991-01-01T00:00:00.000Z",
"key": 662688000000,
"doc_count": 0,
"avg_salary": {
"value": null
},
"derivative_avg_salary": {
"value": null
}
},
{
"key_as_string": "1992-01-01T00:00:00.000Z",
"key": 694224000000,
"doc_count": 0,
"avg_salary": {
"value": null
},
"derivative_avg_salary": {
"value": null
}
},
{
"key_as_string": "1993-01-01T00:00:00.000Z",
"key": 725846400000,
"doc_count": 0,
"avg_salary": {
"value": null
},
"derivative_avg_salary": {
"value": null
}
},
{
"key_as_string": "1994-01-01T00:00:00.000Z",
"key": 757382400000,
"doc_count": 1,
"avg_salary": {
"value": 5000
},
"derivative_avg_salary": {
"value": null
}
}
]
}
}
}