elasticsearch - Elasticsearch 中多个字段的Groupby功能

Question

我有一个要求，我需要根据状态和给定日期的区域对status_value进行分组。出于同样的原因，我编写了一个查询，但它在ES中并不完全有效。如果有人调查并为我提供解决方案，那将是一个很大的帮助。

注意:我想获取最后一天(即前一天)的结果。

{
  "query": {
    "filtered": {
      "query": {
        "match_all": {}
      },
      "filter": {
        "term": {
          "UsagePoint_Asset_lifecycle_installationDate": "2014-07-13T16:55:00.0-07:00"
        }
      }
    }
  },
    "aggs" : {
        "product" : {
            "terms" : {
                "field" : "UsagePoint_ServiceLocation_region"
            },
            "aggs" : {
                "material" : {
                    "terms" : {
                        "field" : "UsagePoint_status_value"
                    }
                }
            }
        }       
    }
}

我的SQL查询可能如下所示:

select count(status_value)
from products 
where date = "yesterday"
group by region , date

请检查以下查询是否有效，但我想获取特定日期或日期的值。

{
    "agg1": {
        "terms": {
           "field":"UsagePoint_Asset_lifecycle_installationDate"
        },
        "aggs" : {
        "product" : {
            "terms" : {
                "field" : "UsagePoint_ServiceLocation_region"
            },
            "aggs" : {
                "material" : {
                    "terms" : {
                        "field" : "UsagePoint_status_value"
                    }
                }
            }
        }       
    }
    }
}

Answer 1

如果您需要昨天的信息分组，以下为解决方案。
对于其他任何自定义日期，请更改gte(大于或等于)和lt(小于)的值

{
  "query": {
    "filtered": {
      "query": {
        "match_all": {}
      },
      "filter": {
        "range": {
          "UsagePoint_Asset_lifecycle_installationDate": {
            "gte": "now-1d",
            "lt": "now"
          }
        }
      }
    }
  },
  "aggs": {
    "product": {
      "terms": {
        "field": "UsagePoint_ServiceLocation_region"
      },
      "aggs": {
        "material": {
          "terms": {
            "field": "UsagePoint_status_value"
          }
        }
      }
    }
  }
}