Elasticsearch 聚合返回多个字段

Question

这个问题不是如何通过多个字段进行聚合，我们可以使用子聚合。

如果你懂SQL，我可以给你一个完美的解释:

SELECT SUM(SomeField1), MAX(SomeField2), MIN(SomeField3), AVG(SomeField4) FROM FooTable
GROUP BY Key1, Key2, Key3

我们可以在 Elasticsearch 中实现这一点吗？

谢谢。

Answer 1

是的，需要按Key1进行聚合，然后为Key2和Key3添加两个子聚合，最后添加一个metric子-每个 SomeField* 的聚合，基本上是这样的:

{
  "size": 0,
  "aggs": {
    "key1": {
      "terms": {
        "field": "Key1"
      },
      "aggs": {
        "key2": {
          "terms": {
            "field": "Key2"
          },
          "aggs": {
            "key3": {
              "terms": {
                "field": "Key3"
              },
              "aggs": {
                "somefield1": {
                  "sum": {
                    "field": "SomeField1"
                  }
                },
                "somefield2": {
                  "max": {
                    "field": "SomeField2"
                  }
                },
                "somefield3": {
                  "min": {
                    "field": "SomeField3"
                  }
                },
                "somefield4": {
                  "avg": {
                    "field": "SomeField4"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}