elasticsearch min和max在其他聚合結果上的合併

Question

我試圖在elasticsearch中查找聚合結果的最小值和最大值。什麼查詢將允許它先通過字段進行彙總，然後執行月度子彙總以獲取該字段的月度數據，然後在那些每月計算的度量標準中查找最小值和最大值。 我被困在發現min和max。對於以下要求的其餘部分是我的查詢

這個問題可以表述爲：什麼是在任何國家的最大和最小交易（考慮所有月份）？ 這裏，我試圖查詢：

{ 
    "query": { 
    "bool": { 
     "must": [ 
     { 
      "term": { 
      "Id": "7466swy7893jgs225" 
      } 
     } 
     ] 
    } 
    }, 
    "aggs": { 
    "dimension": { 
     "terms": { 
     "field": "country" 
     }, 
     "aggs": { 
     "MoM": { 
      "date_histogram": { 
      "field": "date", 
      "interval": "month", 
      "format": "MMM YY" 
      }, 
      "aggs": { 
      "totalValue": { 
       "sum": { 
       "field": "Transactions" 
       } 
      } 
      } 
     } 
     } 
    } 
    }, 
    "size": 0 

}

這是我得到的輸出：

{ 
    "aggregations": { 
    "dimension": { 
    "doc_count_error_upper_bound": 0, 
    "sum_other_doc_count": 0, 
    "buckets": [ 
    { 
     "key": "USA", 
     "doc_count": 392, 
     "MoM": { 
      "buckets": [ 
      { 
      "key_as_string": "jan 16", 
      "key": 1462060800000, 
      "doc_count": 31, 
      "totalValue": { "value": 352 } 
      }, 
      { 
      "key_as_string": "Feb 16", 
      "key": 1462060800000, 
      "doc_count": 31, 
      "totalValue": { "value": 429 } 
      } 
     ??????????????/MIN and MAX of 352 AND 429 
      ] 
     } 
    }, 
    { 
     "key": "Bhutan", 
     "doc_count": 392, 
     "MoM": { 
      "buckets": [ 
      { 
      "key_as_string": "Jan 16", 
      "key": 1462060800000, 
      "doc_count": 31, 
      "totalValue": {"value": 750 } 
      } 
      , 
      { 
      "key_as_string": "Feb 16", 
      "key": 1464739200000, 
      "doc_count": 30, 
      "totalValue": {"value": 827 } 
     } 
      ??????????????/MIN and MAX of 750 AND 827 

     ] 
    } 
    } 
] 
} 
}} 

Answer 1

您需要使用Pipeline Aggregation.。嘗試Max Bucket和Min Bucket聚集

{ 
"size": 0, 
"aggs": { 
    "dimension": { 
    "terms": { 
     "field": "country" 
    }, 
    "aggs": { 
     "MoM": { 
      "date_histogram": { 
       "field": "date", 
       "interval": "month", 
       "format": "MMM YY" 
      }, 
      "aggs": { 
       "totalValue": { 
       "sum": { 
        "field": "transactions" 
       } 
       } 
      } 
     }, 
     "max_monthly_temp": { 
      "max_bucket": { 
       "buckets_path": "MoM>totalValue" 
      } 
     }, 
     "min_monthly_temp": { 
      "min_bucket": { 
       "buckets_path": "MoM>totalValue" 
       } 
      } 
     } 
     } 
    } 
} 

輸出會有點像：

"buckets": [ 
     { 
      "key": "India", 
      "doc_count": 5, 
      "MoM": { 
       "buckets": [ 
       { 
        "key_as_string": "Feb 17", 
        "key": 1485907200000, 
        "doc_count": 3, 
        "totalValue": { 
         "value": 260 
        } 
       }, 
       { 
        "key_as_string": "Mar 17", 
        "key": 1488326400000, 
        "doc_count": 1, 
        "totalValue": { 
         "value": 115 
        } 
       }, 
       { 
        "key_as_string": "Apr 17", 
        "key": 1491004800000, 
        "doc_count": 1, 
        "totalValue": { 
         "value": 5 
        } 
       } 
       ] 
      }, 
      "max_monthly_temp": { 
       "value": 260, 
       "keys": [ 
       "Feb 17" 
       ] 
      }, 
      "min_monthly_temp": { 
       "value": 5, 
       "keys": [ 
       "Apr 17" 
       ] 
      } 
     }, 
    ...... 
     ] 

希望這有助於..

Answer 2

嘗試用下面的查詢。 在aggs字段中添加最小和最大度量標準。

{ 
    "query": { 
    "bool": { 
     "must": [ 
     { 
      "term": { 
      "Id": "7466swy7893jgs225" 
      } 
     } 
     ] 
    } 
    }, 
    "aggs": { 
    "dimension": { 
     "terms": { 
     "field": "country" 
     }, 
     "aggs": { 
     "MoM": { 
      "date_histogram": { 
      "field": "date", 
      "interval": "month", 
      "format": "MMM YY" 
      }, 
      "aggs": { 
      "totalValue": { 
       "sum": { 
       "field": "Transactions" 
       } 
      }, 
      "min":{ 
       "min":{ 
       "field":"Transactions" 
       } 
      }, 
      "max":{ 
       "max":{ 
       "field":"Transactions" 
       } 
      } 
      } 
     } 
     } 
    } 
    }, 
    "size": 0 
}