elasticsearch - 弹性平均Bool查询中的聚合

Question

在Elastic中，我试图对 bool(boolean) 查询过滤器进行平均聚合。但是我得到无法解析名称为[query]的BaseAggregationBuilder:解析器未找到。
我的目标:

过滤进程名称: AddCustomer 和消息类型:响应文档。

使用字段 elapsed_time

查找过滤数据的平均响应时间

我的代码

{
  "from": 0,
  "size": 20,
  "aggs": {
    "filtered_elapsed_time": {
        "query": {
            "bool": {
              "should": [
                {
                  "bool": {
                    "must": [
                      {
                        "match": {
                          "processName": "AddCustomer"
                        }
                      },
                      {
                        "match": {
                          "messageType": "Response"
                        }
                      }
                    ]
                  }
                }
              ]
            }       
      },
      "aggs": {
        "avg_et": {
          "avg": {
            "field": "elapsed_time"
          }
        }
      }
    }
  }
}  

错误响应

{
  "error": {
    "root_cause": [
      {
        "type": "named_object_not_found_exception",
        "reason": "[6:18] unable to parse BaseAggregationBuilder with name [query]: parser not found"
      }
    ],
    "type": "named_object_not_found_exception",
    "reason": "[6:18] unable to parse BaseAggregationBuilder with name [query]: parser not found"
  },
  "status": 400
}

Answer 1

添加带有索引数据，搜索查询和搜索结果的工作示例
索引数据:

{
  "processName":"AddCustomer",
  "messageType":"Response",
   "elapsed_time":20
}
{
  "processName":"AddCustomer",
  "messageType":"Response",
   "elapsed_time":10
}

搜索查询:

{                   <-- note this
  "query": {
    "bool": {
      "should": [
        {
          "bool": {
            "must": [
              {
                "match": {
                  "processName": "AddCustomer"
                }
              },
              {
                "match": {
                  "messageType": "Response"
                }
              }
            ]
          }
        }
      ]
    }
  },
  "aggs": {
    "avg_et": {
      "avg": {
        "field": "elapsed_time"
      }
    }
  }
}

搜索结果:

"hits": [
      {
        "_index": "64444060",
        "_type": "_doc",
        "_id": "1",
        "_score": 0.36464313,
        "_source": {
          "processName": "AddCustomer",
          "messageType": "Response",
          "elapsed_time": 10
        }
      },
      {
        "_index": "64444060",
        "_type": "_doc",
        "_id": "2",
        "_score": 0.36464313,
        "_source": {
          "processName": "AddCustomer",
          "messageType": "Response",
          "elapsed_time": 20
        }
      }
    ]
  },
  "aggregations": {
    "avg_et": {
      "value": 15.0        <-- note this
    }
  }

更新1:
只需将query替换为filter关键字，您的搜索查询也将起作用
如果使用 Filter aggregation将当前聚合上下文范围缩小到一组特定的文档，则修改后的搜索查询将是:

{
  "from": 0,
  "size": 20,
  "aggs": {
    "filtered_elapsed_time": {
      "filter": {               <-- note this
        "bool": {
          "should": [
            {
              "bool": {
                "must": [
                  {
                    "match": {
                      "processName": "AddCustomer"
                    }
                  },
                  {
                    "match": {
                      "messageType": "Response"
                    }
                  }
                ]
              }
            }
          ]
        }
      },
      "aggs": {
        "avg_et": {
          "avg": {
            "field": "elapsed_time"
          }
        }
      }
    }
  }
}