ElasticSearch - 聚合 + 范围 + 词条查询答案

【问题标题】：ElasticSearch - Aggregation + Range + Term queryElasticSearch - 聚合 + 范围 + 词条查询
【发布时间】：2020-09-18 15:13:43
【问题描述】：

使用 ElasticSearch，我想通过过滤另一个字段的值来获取一段时间内某个字段的总和。

我定义了这个映射：

PUT match-orders
{
    "settings" : {
        "number_of_shards" : 1,
        "number_of_replicas" : 0
    },
    "mappings": {
        "order": {
            "_all": {"enabled": false},
            "properties": {
                "matchTime": {"type": "date", "index": "true"},
                "product_id": {"type": "keyword", "index": "true"},
                "size": {"type": "float", "index": "true"},
                "price": {"type": "float", "index": "true"},
                "side": {"type": "keyword", "index": "true"}
            }
        }
    }
}

我可以得到一个范围的总和：

POST /match-orders/_search?pretty
{
    "aggs" : {
    "price_ranges" : {
            "range" : {
                "field" : "matchTime",
                "ranges" : [
                    { "from" : "2017-09-10T18:00:00Z", "to" : "2017-09-10T18:15:00Z" }
                ]
            },
            "aggs" : {
                "result" : { "sum" : { "field" : "size" } }
            }
        }
    }
}

我可以得到包含特定术语的文档：

POST /match-orders/_search?pretty
{
    "query": {
        "term" : { "side" : "sell" } 
    }
}

但是我该如何组合这两个查询呢？

谢谢你:)

【问题讨论】：

标签： elasticsearch

【解决方案1】：

您只需将查询与聚合合并，如下所示：

POST /match-orders/_search?pretty
{
    "query": {
        "term" : { "side" : "sell" } 
    },
    "aggs" : {
        "price_ranges" : {
            "range" : {
                "field" : "matchTime",
                "ranges" : [
                    { "from" : "2017-09-10T18:00:00Z", "to" : "2017-09-10T18:15:00Z" }
                ]
            },
            "aggs" : {
                "result" : { "sum" : { "field" : "size" } }
            }
        }
    }
}

【讨论】：

【解决方案2】：

{
  "aggs" : {
    "all_xxx" : {
      "terms" : { "field" : "xxx", "size" : 1000 }
    },
    "custom_range" : {
      "range" : { "field" : "datetime", "ranges" : [{ "from" : "2020-09-11 12:06:27" }, { "to" : "now" }] }
    }
  },
  size: 0
}

【讨论】：

此查询返回匹配“terms”的文档的聚合和匹配“range”的文档的聚合，但不要组合这两个条件（匹配“terms”和“range”的文档）跨度>

【解决方案3】：

按照术语查询的插值应该做 -

POST /match-orders/_search?pretty
{
    "aggs" : {
        "price_ranges" : {
            "range" : {
                "field" : "matchTime",
                "ranges" : [
                    { "from" : "2017-09-10T18:00:00Z", "to" : "2017-09-10T18:15:00Z" }
                ]
            },
            "terms" : {
                 "field" : "side",
                 "include" : ["sell"]
             },
            "aggs" : {
                "result" : { "sum" : { "field" : "size" } }
            }
        }
    }
}

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#_filtering_values_with_exact_values

【讨论】：

此查询返回错误："root_cause": [ { "type": "parsing_exception", "reason": "在 [price_ranges] 中找到两个聚合类型定义：[range] 和 [terms] ", "行": 10, "col": 23 } ]
这个查询无效，不能这样添加range和term