Elasticsearch 过滤计数大于 x 的聚合结果

Question

我有以下 Elasticsearch 查询，以便从按市场 ID 分组的 Elasticsearch 中获得最高的总毫秒数。

    {
  "from": 0,
  "size": 0,
  "query": {
  "filtered": {
    "filter": {
      "and": [
        {
          "term": {
            "@type": "tradelog"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now-7d",
              "lt": "now"
            }
          }
        },
        {
          "range": {
            "TotalMs": {
              "gte": 200,
              "lt": 2000
            }
          }
        }
      ]
    }
  }

},
"aggregations": {
      "the_name": {
         "terms": {
            "field": "Market",
            "order" : { "totalms_avg" : "desc" }
         },
         "aggregations": {
            "totalms_avg": {
               "avg": {
                  "field": "TotalMs"
               }
            }
         }
      }
   }
}

此查询返回几个只有 1 个结果的存储桶，这些存储桶在我的数据中是离群值，因此我不希望将它们包括在内。是否可以过滤掉任何计数小于 5 的桶？ Elasticsearch 等同于SQLs 'HAVING'子句。

Answer 1

是的，您可以使用 min_doc_count setting

...
"aggregations": {
      "the_name": {
         "terms": {
            "field": "Market",
            "order" : { "totalms_avg" : "desc" },
            "min_doc_count": 5
         },
         "aggregations": {
            "totalms_avg": {
               "avg": {
                  "field": "TotalMs"
               }
            }
         }
      }
   }
}