如何在 ElasticSearch 结果中隐藏存储桶？

Question

在我的查询中，我将存储桶聚合为一个标量。由于我对每个存储桶（在我的情况下是数千万存储桶）不感兴趣，因此我想将它们从返回的结果中删除；即我想做类似 "size":0 的事情来隐藏所有的点击。有可能吗？

例如：

{
  "size": 0,
  "aggs": {
    "pop": {
      "terms": {
        "field": "account_number",
        "size": 0
      },
      "aggs": { 
            "average": { 
               "avg": {
                  "field": "price" 
               }
            }
         }
    },
    "sum_of_avg": {
      "sum_bucket": {
        "buckets_path": "pop>average"
      }
    }
  }
}

结果：

[...]
"aggregations": {
    "pop": {
      "doc_count_error_upper_bound": 40851,
      "sum_other_doc_count": 93441329,
      "buckets": [...] <== i don't want this
    },
    "sum_of_avg": {
      "value": 128.0768325884469
    }

Answer 1

我刚刚在相关问题中发布了answer。

在这种情况下，请求应如下所示：

curl -XPOST 'http://localhost:9200/<index>/_search?filter_path=aggregations.sum_of_avg' -d '
{
  "size": 0,
  "aggs": {
    "pop": {
      "terms": {
        "field": "account_number",
        "size": 0
      },
      "aggs": { 
            "average": { 
               "avg": {
                  "field": "price" 
               }
            }
         }
    },
    "sum_of_avg": {
      "sum_bucket": {
        "buckets_path": "pop>average"
      }
    }
  }
}

PS：如果您找到其他解决方案，请在此处分享。谢谢！

Answer 2

我认为您想要的是“基数”聚合。这将返回给您不同值的数量。

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-cardinality-aggregation.html

例子：

GET devdev/alert/_search
{
  "size": 0,
  "aggs": {
    "agg1": {
      "cardinality": {
        "field": "price"
      }
    }
  }
}