要在Elasticsearch中按多个字段分组并求和小时数,你可以使用聚合功能。以下是一个示例,假设你有一个名为"events"的索引,其中包含"time_in_hours"字段(表示小时数)以及其他用于分组的字段(如"group_by_field1"和"group_by_field2"):
GET /events/_search
{
"size": 0,
"aggs": {
"group_by_field1": {
"terms": {
"field": "group_by_field1"
},
"aggs": {
"group_by_field2": {
"terms": {
"field": "group_by_field2"
},
"aggs": {
"sum_hours": {
"sum": {
"field": "time_in_hours"
}
}
}
}
}
}
}
}
这个查询将按"group_by_field1"和"group_by_field2"字段分组,并计算每个组的"time_in_hours"字段之和。
size: 0
表示不返回匹配的文档,只返回聚合结果。aggs
定义了聚合操作。group_by_field1
是一个terms
聚合,按"group_by_field1"字段分组。group_by_field1
聚合内部,嵌套了另一个terms
聚合group_by_field2
,按"group_by_field2"字段分组。group_by_field2
聚合内部,定义了一个sum
聚合sum_hours
,用于计算每个组的"time_in_hours"字段之和。{
"aggregations": {
"group_by_field1": {
"buckets": [
{
"key": "value1",
"doc_count": 10,
"group_by_field2": {
"buckets": [
{
"key": "valueA",
"doc_count": 5,
"sum_hours": {
"value": 12.5
}
},
{
"key": "valueB",
"doc_count": 5,
"sum_hours": {
"value": 7.5
}
}
]
}
},
{
"key": "value2",
"doc_count": 5,
"group_by_field2": {
"buckets": [
{
"key": "valueA",
"doc_count": 3,
"sum_hours": {
"value": 4.5
}
},
{
"key": "valueB",
"doc_count": 2,
"sum_hours": {
"value": 3.0
}
}
]
}
}
]
}
}
}
这个响应表示按"group_by_field1"和"group_by_field2"分组后的求和结果。例如,当"group_by_field1"为"value1"且"group_by_field2"为"valueA"时,"time_in_hours"的总和为12.5。
领取专属 10元无门槛券
手把手带您无忧上云