elasticsearch - 嵌套聚合的问题ElasticSearch:在最大值之后求和

Question

我知道度量聚合无法实现子聚合，而Elasticsearch支持带有存储桶的子聚合。但是我对如何做到这一点有些迷茫。

我想在嵌套聚合之后以及通过最大时间戳聚合之后做一个总和。

类似于下面的代码，给我这个错误:“类型为[max]的聚合器[max_date_aggs]无法接受子聚合”，这是正常现象。有办法使它起作用吗？

{
"aggs": {
    "sender_comp_aggs": {
        "terms": {
            "field": "senderComponent"
        },
        "aggs": {
            "activity_mnemo_aggs": {
                "terms": {
                    "field": "activityMnemo"
                },
                "aggs": {
                    "activity_instance_id_aggs": {
                        "terms": {
                            "field": "activityInstanceId"
                        },
                        "aggs": {
                            "business_date_aggs": {
                                "terms": {
                                    "field": "correlationIdSet.businessDate"
                                },
                                "aggs": {
                                    "context_set_id_closing_aggs": {
                                        "terms": {
                                            "field": "contextSetId.closing"
                                        },
                                        "aggs": {
                                            "max_date_aggs": {
                                                "max": {
                                                    "field": "timestamp"
                                                },
                                                "aggs" : {
                                                    "sum_done": {
                                                        "sum": {
                                                            "field": "itemNumberDone"
                                                        }
                                                    }
                                                }
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }

谢谢

Answer 1

我不是100％不确定要实现什么，如果您也将共享映射会有所帮助。

桶聚合是关于定义桶/组的。正如您在示例中所做的那样，您可以包装/嵌套存储桶聚合，以进一步将存储桶分解为子存储桶，依此类推。

默认情况下，Elasticsearch总是计算计数指标，但是您也可以指定其他指标以进行计算。一个指标是针对每个存储桶/针对一个存储桶(而不是另一个指标)计算的，这就是为什么您不能将一个指标聚合嵌套在一个指标聚合之下，这根本没有意义。

根据您的数据看起来像是您可能需要做的唯一更改，是将sum_done聚合移出aggs-子句，移至与max_date_aggs -aggregation相同的级别。

代码段

"aggs": {
  "max_date_aggs": { "max": {"field": "timestamp"} },
  "sum_done": { "sum": { "field": "itemNumberDone"} }
}

在您对问题进行细化并提供之后，我设法提出了一个仅需一个请求的解决方案。如前所述， sum -metric聚合需要在存储桶上而非度量上进行操作。解决方案非常简单:无需计算 max -date，只需将这种聚合重新构造为 terms -aggregation，并按时间戳的降序进行排序即可，只需要一个存储桶即可。

解决方案

GET gos_element/_search
{
  "size": 0, 
  "aggs": {
    "sender_comp_aggs": {
      "terms": {"field": "senderComponent.keyword"},
      "aggs": {
        "activity_mnemo_aggs": {
          "terms": {"field": "activityMnemo.keyword"},
          "aggs": {
            "activity_instance_id_aggs": {
              "terms": {"field": "activityInstanceId.keyword"},
              "aggs": {
                "business_date_aggs": {
                  "terms": {"field": "correlationIdSet.businessDate"},
                  "aggs": {
                    "context_set_id_closing_aggs": {
                      "terms": {"field": "contextSetId.closing.keyword"},
                      "aggs": {
                        "max_date_bucket_aggs": {
                          "terms": {
                            "field": "timestamp",
                            "size": 1, 
                            "order": {"_key": "desc"} 
                          },
                          "aggs": {
                            "sum_done": {
                              "sum": {"field": "itemNumberDone"}
                            }
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

当我依靠默认的Elasticsearch映射时，我不得不引用字段的 .keyword -version。如果您的字段直接映射到 keyword类型的字段，则不需要这样做。

使用以下2条命令为您提供的文档建立索引后，您可以立即测试上述请求:

PUT gos_element/_doc/AW_yu3dIa2R_HwqpSz
{
  "senderComponent": "PS",
  "timestamp": "2020-01-28T02:31:00Z",
  "activityMnemo": "PScommand",
  "activityInstanceId": "123466",
  "activityStatus": "Progress",
  "activityStatusNumber": 300,
  "specificActivityStatus": "",
  "itemNumberTotal": 10,
  "itemNumberDone": 9,
  "itemNumberInError": 0,
  "itemNumberNotStarted": 1,
  "itemNumberInProgress": 0,
  "itemUnit": "Command",
  "itemList": [],
  "contextSetId": {
    "PV": "VAR",
    "closing": "PARIS"
  },
  "correlationIdSet": {
    "closing": "PARIS",
    "businessDate": "2020-01-27",
    "correlationId": "54947df8-0e9e-4471-a2f9-9af509fb5899"
  },
  "errorSet": [],
  "kpiSet": "",
  "activitySpecificPayload": "",
  "messageGroupUUID": "54947df8-0e9e-4471-a2f9-9af509fb5899"
}


PUT gos_element/_doc/AW_yu3dIa2R_HwqpSz8z
{
  "senderComponent": "PS",
  "timestamp": "2020-01-28T03:01:00Z",
  "activityMnemo": "PScommand",
  "activityInstanceId": "123466",
  "activityStatus": "End",
  "activityStatusNumber": 200,
  "specificActivityStatus": "",
  "itemNumberTotal": 10,
  "itemNumberDone": 10,
  "itemNumberInError": 0,
  "itemNumberNotStarted": 0,
  "itemNumberInProgress": 0,
  "itemUnit": "Command",
  "itemList": [],
  "contextSetId": {
    "PV": "VAR",
    "closing": "PARIS"
  },
  "correlationIdSet": {
    "closing": "PARIS",
    "businessDate": "2020-01-27",
    "correlationId": "54947df8-0e9e-4471-a2f9-9af509fb5899"
  },
  "errorSet": [],
  "errorMessages": "",
  "kpiSet": "",
  "activitySpecificPayload": "",
  "messageGroupUUID": "54947df8-0e9e-4471-a2f9-9af509fb5899"
}

结果，您将获得以下响应(预期值为10):

{
  "took" : 8,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 2,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "sender_comp_aggs" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "PS",
          "doc_count" : 2,
          "activity_mnemo_aggs" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "PScommand",
                "doc_count" : 2,
                "activity_instance_id_aggs" : {
                  "doc_count_error_upper_bound" : 0,
                  "sum_other_doc_count" : 0,
                  "buckets" : [
                    {
                      "key" : "123466",
                      "doc_count" : 2,
                      "business_date_aggs" : {
                        "doc_count_error_upper_bound" : 0,
                        "sum_other_doc_count" : 0,
                        "buckets" : [
                          {
                            "key" : 1580083200000,
                            "key_as_string" : "2020-01-27T00:00:00.000Z",
                            "doc_count" : 2,
                            "context_set_id_closing_aggs" : {
                              "doc_count_error_upper_bound" : 0,
                              "sum_other_doc_count" : 0,
                              "buckets" : [
                                {
                                  "key" : "PARIS",
                                  "doc_count" : 2,
                                  "max_date_bucket_aggs" : {
                                    "doc_count_error_upper_bound" : 0,
                                    "sum_other_doc_count" : 1,
                                    "buckets" : [
                                      {
                                        "key" : 1580180460000,
                                        "key_as_string" : "2020-01-28T03:01:00.000Z",
                                        "doc_count" : 1,
                                        "sum_done" : {
                                          "value" : 10.0
                                        }
                                      }
                                    ]
                                  }
                                }
                              ]
                            }
                          }
                        ]
                      }
                    }
                  ]
                }
              }
            ]
          }
        }
      ]
    }
  }
}