elasticsearch - ElasticSearch-聚合+范围+字词查询

Question

使用ElasticSearch，我想通过过滤另一个字段的值来获得一个字段在一段时间内的总和。

我定义了这个映射:

PUT match-orders
{
    "settings" : {
        "number_of_shards" : 1,
        "number_of_replicas" : 0
    },
    "mappings": {
        "order": {
            "_all": {"enabled": false},
            "properties": {
                "matchTime": {"type": "date", "index": "true"},
                "product_id": {"type": "keyword", "index": "true"},
                "size": {"type": "float", "index": "true"},
                "price": {"type": "float", "index": "true"},
                "side": {"type": "keyword", "index": "true"}
            }
        }
    }
}

我可以得到一个范围的总和:

POST /match-orders/_search?pretty
{
    "aggs" : {
    "price_ranges" : {
            "range" : {
                "field" : "matchTime",
                "ranges" : [
                    { "from" : "2017-09-10T18:00:00Z", "to" : "2017-09-10T18:15:00Z" }
                ]
            },
            "aggs" : {
                "result" : { "sum" : { "field" : "size" } }
            }
        }
    }
}

我可以获得包含特定术语的文档:

POST /match-orders/_search?pretty
{
    "query": {
        "term" : { "side" : "sell" } 
    }
}

但是，如何合并这两个查询？

谢谢 :)

Answer 1

您只需要像这样将查询与聚合合并即可:

POST /match-orders/_search?pretty
{
    "query": {
        "term" : { "side" : "sell" } 
    },
    "aggs" : {
        "price_ranges" : {
            "range" : {
                "field" : "matchTime",
                "ranges" : [
                    { "from" : "2017-09-10T18:00:00Z", "to" : "2017-09-10T18:15:00Z" }
                ]
            },
            "aggs" : {
                "result" : { "sum" : { "field" : "size" } }
            }
        }
    }
}