elasticsearch - Elasticsearch 多重聚合

Question

我有两个 Elasticsearch 查询

1. 获取特定日期的交易信息
2. 用于获取所有天的交易信息

如何将这两个查询合并为一个查询？我正在努力为这两个相似的需求编写一个单一的查询。请帮我解决这个问题。谢谢

{
  "query": {
    "filtered": {
      "query": {
        "match": {
          "payment_type": "paypal"
        }
      },
      "filter": {
        "range": {
          "transaction_date": {
            "from": "2014-11-10",
            "to": "2014-11-10"
          }
        }
      }
    }
  },
  "aggs": {
    "daily_price_sum": {
      "sum": {
        "field": "price"
      }
    },
    "daily_post_sum": {
      "sum": {
        "field": "purchased_post_count"
      }
    }
  }
}


{
  "size": 0, 
  "query": {
    "match": {
      "payment_type": "paypal"
    }
  },
  "aggs": {
    "daily_price_sum": {
      "sum": {
        "field": "price"
      }
    },
    "daily_post_sum": {
      "sum": {
        "field": "purchased_post_count"
      }
    }
  }
}

Answer 1

如果你使用的ES版本低于1.4.0，你可以使用Filter Aggregations .相同的查询如下:

{
   "size": 0,
   "query": {
      "match": {
         "payment_type": "paypal"
      }
   },
   "aggs": {
      "daily_price_sum": {
         "sum": {
            "field": "price"
         }
      },
      "daily_post_sum": {
         "sum": {
            "field": "purchased_post_count"
         }
      },
      "one_day_aggs": {
         "filter": {
            "range": {
               "transaction_date": {
                  "from": "2014-11-10",
                  "to": "2014-11-10"
               }
            }
         },
         "aggs": {
            "daily_price_sum": {
               "sum": {
                  "field": "price"
               }
            },
            "daily_post_sum": {
               "sum": {
                  "field": "purchased_post_count"
               }
            }
         }
      }
   }
}

但是如果你使用的是 ES 1.4.0，那么你可以使用 Filters Aggregation使查询更紧凑。相同的查询如下:

{
   "size": 0,
   "query": {
      "match": {
         "payment_type": "paypal"
      }
   },
   "aggs": {
      "transactions": {
         "filters": {
            "filters": {
               "one_day": {
                  "range": {
                     "transaction_date": {
                        "from": "2014-11-10",
                        "to": "2014-11-10"
                     }
                  }
               },
               "all_days": {
                  "match_all": {}
               }
            }
         },
         "aggs": {
            "daily_price_sum": {
               "sum": {
                  "field": "price"
               }
            },
            "daily_post_sum": {
               "avg": {
                  "field": "purchased_post_count"
               }
            }
         }
      }
   }
}

我还看到您对查询命中不感兴趣，只对聚合值感兴趣。在这种情况下，您可以通过使用 Shard Query Cache 来提高这些聚合的性能。存在于 ES 1.4.0 中。要使用它，请启用链接中提到的分片查询缓存并将以下参数添加到 _search 操作:search_type=count。