ES-aggregation聚合分析

集合的分类

Bucket Aggregation

  一些列满足特定条件的文档集。

Metric Aggregation

  一些数学运算，可以对文档字段进行统计分析。

  Metric会基于数据集计算结果，除了支持在字段上进行计算，同样也支持在脚步（painless script）产生的结果之上进行计算。

  大多数Metric是数学计算，仅输出一个值。
  min / max / sum / avg / cardinality

  部分Metric支持输出多个数值。
  stats / percentiles /percentile_ranks

  实战：查询航班目的地/出发地的统计信息、机票平均价、最贵机票价、最便宜机票价

get kibana_sample_data_flights/_mappings
# 输出
{
    
  "kibana_sample_data_flights" : {
    
    "mappings" : {
    
      "properties" : {
    
        "AvgTicketPrice" : {
    
          "type" : "float"
        },
        "Cancelled" : {
    
          "type" : "boolean"
        },
        "Carrier" : {
    
          "type" : "keyword"
        },
        "Dest" : {
    
          "type" : "keyword"
        },
        "DestAirportID" : {
    
          "type" : "keyword"
        },
        "DestCityName" : {
    
          "type" : "keyword"
        },
        "DestCountry" : {
    
          "type" : "keyword"
        },
        "DestLocation" : {
    
          "type" : "geo_point"
        },
        "DestRegion" : {
    
          "type" : "keyword"
        },
        "DestWeather" : {
    
          "type" : "keyword"
        },
        "DistanceKilometers" : {
    
          "type" : "float"
        },
        "DistanceMiles" : {
    
          "type" : "float"
        },
        "FlightDelay" : {
    
          "type" : "boolean"
        },
        "FlightDelayMin" : {
    
          "type" : "integer"
        },
        "FlightDelayType" : {
    
          "type" : "keyword"
        },
        "FlightNum" : {
    
          "type" : "keyword"
        },
        "FlightTimeHour" : {
    
          "type" : "keyword"
        },
        "FlightTimeMin" : {
    
          "type" : "float"
        },
        "Origin" : {
    
          "type" : "keyword"
        },
        "OriginAirportID" : {
    
          "type" : "keyword"
        },
        "OriginCityName" : {
    
          "type" : "keyword"
        },
        "OriginCountry" : {
    
          "type" : "keyword"
        },
        "OriginLocation" : {
    
          "type" : "geo_point"
        },
        "OriginRegion" : {
    
          "type" : "keyword"
        },
        "OriginWeather" : {
    
          "type" : "keyword"
        },
        "dayOfWeek" : {
    
          "type" : "integer"
        },
        "timestamp" : {
    
          "type" : "date"
        }
      }
    }
  }
}

get kibana_sample_data_flights/_search
{
    
  "size":0,
  "aggs":{
    
    "flight_dest":{
    
      //类似 select DestCountry count(*) from x group by DestCountry
      "terms":{
    
        "field": "DestCountry"
      },
      //aggs 开启统计
      "aggs": {
    
        // average_price 存储统计结果名称
        "average_price": {
    
          //avg 为统计函数
          "avg": {
    
            //根据AvgTicketPrice字段进行统计
            "field": "AvgTicketPrice"
          }
        },
        "max_price":{
    
          "max": {
    
            "field": "AvgTicketPrice"
          }
        },
        "min_price":{
    
          "min": {
    
            "field": "AvgTicketPrice"
          }
        },
        "stat_price":{
    
          //stats 包含min/max/avg/sum统计
          "stats": {
    
            "field": "AvgTicketPrice"
          }
        },
        "weather":{
    
          "terms": {
    
            "field": "DestWeather"
          }
        }
      }
    }
  }
}

  结果输出：

{
    
  "took" : 18,
  "timed_out" : false,
  "_shards" : {
    
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    
    "total" : {
    
      "value" : 10000,
      "relation" : "gte"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    
    "flight_dest" : {
    
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 3187,
      "buckets" : [
        {
    
          "key" : "IT",
          "doc_count" : 2371,
          "max_price" : {
    
            "value" : 1195.3363037109375
          },
          "min_price" : {
    
            "value" : 100.57646942138672
          },
          "weather" : {
    
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
    
                "key" : "Clear",
                "doc_count" : 428
              },
              {
    
                "key" : "Sunny",
                "doc_count" : 424
              },
              {
    
                "key" : "Rain",
                "doc_count" : 417
              },
              {
    
                "key" : "Cloudy",
                "doc_count" : 414
              },
              {
    
                "key" : "Heavy Fog",
                "doc_count" : 182
              },
              {
    
                "key" : "Damaging Wind",
                "doc_count" : 173
              },
              {
    
                "key" : "Hail",
                "doc_count" : 169
              },
              {
    
                "key" : "Thunder & Lightning",
                "doc_count" : 164
              }
            ]
          },
          "average_price" : {
    
            "value" : 586.9627099618385
          },
          "stat_price" : {
    
            "count" : 2371,
            "min" : 100.57646942138672,
            "max" : 1195.3363037109375,
            "avg" : 586.9627099618385,
            "sum" : 1391688.585319519
          }
        }
      ]
    }
  }
}

Pipeline Aggregation

  对其他的聚合结果进行二次聚合。

Matrix Aggregation

  支持对多个字段的操作并提供一个结果矩阵。