ElasticSearch如何在总和聚合中进行子聚合

Question

您好，我在 ElasticSearch 中有一个索引： 工厂、部门、日期、价值 我正在尝试在 elasticsearch 中进行查询

1) 按特定部门中的工厂和日期分组并求和：

es = Elasticsearch('elasticsearch:9200')
body = Dict({"query": { 
                "bool": {
                    "must_not": {
                        "match": {
                            "Department": "Indirect*"}}}},
             "aggs": {
                "group_code": {
                    "terms": {
                        "field": "Plant.keyword", "size":10000},
                     "aggs": {
                        "group_date": {
                            "terms": {
                                "field": "Date"},
                             "aggs": {
                                "group_value": {
                                    "sum":{
                                       "field": "Value"}}}}}}}})

2) 按植物和日期范围分组，得到平均值和中位数：

es = Elasticsearch('elasticsearch:9200')
body = Dict(
    {"query": {
            "bool": {
                "must_not": {
                    "match": {
                        "Department_Substrate": "Indirect*"}}}},
     "aggs": {
         "group_code": {
             "terms": {
                 "field": "Plant.keyword",
                 "size": 10000},
             "aggs": {
                 "group_date": {
                     "range": {
                         "field": "Date",
                         "ranges": datelist},
                     "aggs": {
                          "Median": {
                              "percentiles": {
                                  "field": "Value",
                                  "percents": [25]}},
                          "Mean": {
                               "avg": {
                                  "field":
                                  "Value}}}}}}}})

它也可以，但在这种情况下，我之前没有按植物和日期进行分组，所以将两者混合我有类似的东西：

body = Dict({"query": {
                "bool": {
                    "must_not": {
                        "match": {
                            "Department_Substrate": "Indirect*"}}}},
             "aggs": {
                "group_code": {
                    "terms": {
                        "field": "Plant.keyword", "size":10000},
                     "aggs": {
                        "group_date": {
                            "terms": {
                                "field": "Date"},
                             "aggs": {
                                "group_value": {
                                    "sum":{
                                       "field": "Value"},
                                    "aggs": {
                                        "group_date": {
                                            "range": {
                                                "field": "Date",
                                                "ranges": datelist},
                                            "aggs": {
                                                 "Median": {
                                                     "percentiles": {
                                                         "field": "Value",
                                                         "percents": [25]}},
                                                 "Mean": {
                                                      "avg": {
                                                         "field":
                                                         "Value"}}}}}}}}}}}})
res = es.search(index=self.index, doc_type='test', body=body)

我有这个：

TransportError: TransportError(500, 'aggregation_initialization_exception', 'Aggregator [group_value] of type [sum] cannot accept sub-aggregations')

那么有办法做到这一点吗？

如果它可以帮助我之前的代码 python 是：

data = test[~test.Department.str.startswith('Indirect')]
group1 = data.groupby(['Plant', 'Date'])['Value'].sum()
group2 = pd.DataFrame(group1.reset_index()).groupby(['Plant', pd.Grouper(key='Date', freq='W')])['Value'].median()

Answer 1

错误很明显：“[sum] 类型的聚合器 [group_value] 不能接受子聚合” 当您进行“求和”聚合时，您无法再拆分结果。 所以你最好改变 sum aggs 的位置。 即：

{
"query": {
    "bool": {
        "must_not": {
            "match": {
                "Department_Substrate": "Indirect*"
            }
        }
    }
},
"aggs": {
    "group_code": {
        "terms": {
            "field": "Plant.keyword",
            "size": 10000
        },
        "aggs": {
            "group_date": {
                "terms": {
                    "field": "Date"
                },
                "aggs": {
                    "group_date": {
                        "range": {
                            "field": "Date",
                            "ranges": "sdf"
                        },
                        "aggs": {
                            "Median": {
                                "percentiles": {
                                    "field": "Value",
                                    "percents": [
                                        25
                                    ]
                                }
                            },
                            "aggs": {
                                "group_value": {
                                    "sum": {
                                        "field": "Value"
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }