我有一个文件索引是:
id:1
type: Deposit
value:12
timestamp:2022.10.09T00.00.00
####
id:2
type: withdraw
value:15
timestamp:2022.10.9T00.00.00
####
id:3
type: Deposit
value:17
timestamp:2022.10.09T11.00.00
....
因此,我运行多个聚合,例如:
"aggs": {
"s1": {
"terms": {
"field": "type",
"size": 10
},
"aggs": {
"SUM": {
"sum": {
"field": "value"
}
}
}
}
我的结果是:
“桶”:[{“键”:“存”,"doc_count“:9,”所以“:{”值“:78983 },{”键“:”退出“,"doc_count”:9,"SO“:{”值“:777445 }
但我想计算一下“存款价值-取款价值”。这个查询是什么?
发布于 2022-11-01 08:30:43
为此,可以使用bucket_script聚合。桶脚本aggs如下所示。
"diff": {
"bucket_script": {
"buckets_path": {
"my_var1": "s1['field_value']>s2",
"my_var2": "s1['field_value']>s2"
},
"script": "params.my_var1 - params.my_var2"
}
}
我分享下面的细节和解决方案。
POST test_stackoverflow_question/_bulk
{"index":{}}
{"id":"1", "type": "Deposit", "value":12, "timestamp":"2022.10.09T00.00.00"}
{"index":{}}
{"id":"2", "type": "withdraw", "value":15, "timestamp":"2022.10.9T00.00.00"}
{"index":{}}
{"id":"3", "type": "Deposit", "value":17, "timestamp":"2022.10.09T11.00.00"}
同级管道ag可以选择从多个桶中选择特定的密钥,如果术语是指多部分聚合(如agg )的话。例如,bucket_script可以选择(通过包键)两个自定义桶来执行计算:
GET test_stackoverflow_question/_search
{
"size": 0,
"aggs": {
"calculate_diff": {
"filters": {
"filters": {
"all": {
"match_all": {}
}
}
},
"aggs": {
"s1": {
"terms": {
"field": "type.keyword",
"size": 10
},
"aggs": {
"s2": {
"sum": {
"field": "value"
}
}
}
},
"diff": {
"bucket_script": {
"buckets_path": {
"my_var1": "s1['Deposit']>s2",
"my_var2": "s1['withdraw']>s2"
},
"script": "params.my_var1 - params.my_var2"
}
}
}
}
}
}
参考文献:https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-script-aggregation.html https://www.elastic.co/guide/en/elasticsearch/reference/7.17/search-aggregations-pipeline.html
https://stackoverflow.com/questions/74272497
复制相似问题