java - 基于条件的平均 Elasticsearch 查询

Question

我编写了一个 Elasticsearch 查询，其有效负载如下

"userData": [ { "sub":1234, "value":678,"condition":"A"},{ "sub":1234, "value":678,"condition": “B”}]

查询:

{ 
  "aggs": { 
    "student_data": { 
      "date_histogram": { 
        "field":"@timestamp",
        "calendar_interval":"minute"
      },
      "aggs": { 
        "user_avg": { 
          "avg": { 
            "field":"value"
          }
        }
      }
    }
  }
}

结果给出了两个值的平均值，即条件 A 和条件 B 的平均值，但我真正想要的是基于最小间隔的时间段的条件 B 的平均值。

Answer 1

根据您的有效负载，我假设 userData 是一个嵌套类型。

这是一个如何平均每个条件(嵌套内部)的工作示例:

映射

PUT my_index
{
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "userData": {
        "type": "nested",
        "properties": {
          "condition": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "sub": {
            "type": "long"
          },
          "value": {
            "type": "long"
          }
        }
      }
    }
  }
}

索引一些文档

PUT my_index/_doc/1
{
  "@timestamp": "2019-11-08T11:15:24.188Z",
  "userData": [
    {
      "sub": 1234,
      "value": 678,
      "condition": "A"
    },
    {
      "sub": 1234,
      "value": 620,
      "condition": "B"
    }
  ]
}

PUT my_index/_doc/2
{
  "@timestamp": "2019-11-08T11:15:44.188Z",
  "userData": [
    {
      "sub": 1234,
      "value": 680,
      "condition": "A"
    },
    {
      "sub": 1234,
      "value": 640,
      "condition": "B"
    }
  ]
}

搜索查询

GET my_index/_search
{
  "size": 0,
  "aggs": {
    "student_data": {
      "date_histogram": {
        "field": "@timestamp",
        "calendar_interval": "minute"
      },
      "aggs": {
        "data": {
          "nested": {
            "path": "userData"
          },
          "aggs": {
            "condition": {
              "terms": {
                "field": "userData.condition.keyword"
              }, 
              "aggs": {
                "user_avg": {
                  "avg": {
                    "field": "userData.value"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

结果

"student_data" : {
  "buckets" : [
    {
      "key_as_string" : "2019-11-08T11:15:00.000Z",
      "key" : 1573211700000,
      "doc_count" : 2,
      "data" : {
        "doc_count" : 4,
        "condition" : {
          "doc_count_error_upper_bound" : 0,
          "sum_other_doc_count" : 0,
          "buckets" : [
            {
              "key" : "A",
              "doc_count" : 2,
              "user_avg" : {
                "value" : 679.0
              }
            },
            {
              "key" : "B",
              "doc_count" : 2,
              "user_avg" : {
                "value" : 630.0
              }
            }
          ]
        }
      }
    }
  ]
}

希望这有帮助