011-elasticsearch5.4.3【四】-聚合操作【二】-桶聚合【bucket】过滤、嵌套、反转、分组、排序、范围

一、概述

　　bucketing（桶）聚合：划分不同的“桶”，将数据分配到不同的“桶”里。非常类似sql中的group语句的含义。

　　metric既可以作用在整个数据集上，也可以作为bucketing的子聚合作用在每一个“桶”中的数据集上。当然，我们可以把整个数据集合看做一个大“桶”，所有的数据都分配到这个大“桶”中。

1.1、Global聚合

AggregationBuilders

    .global("agg")

    .subAggregation(AggregationBuilders.terms("genders").field("gender"));

使用

import org.elasticsearch.search.aggregations.bucket.global.Global;

// sr is here your SearchResponse object

Global agg = sr.getAggregations().get("agg");

agg.getDocCount(); // Doc count

1.2、过滤聚合

AggregationBuilders

    .filter("agg", QueryBuilders.termQuery("gender", "male"));

使用

import org.elasticsearch.search.aggregations.bucket.filter.Filter;

// sr is here your SearchResponse object

Filter agg = sr.getAggregations().get("agg");

agg.getDocCount(); // Doc count

1.3、多过滤聚合【类似分组聚合,只是筛选出关注的】

AggregationBuilder aggregation =

    AggregationBuilders

        .filters("agg",

            new FiltersAggregator.KeyedFilter("men", QueryBuilders.termQuery("gender", "male")),

            new FiltersAggregator.KeyedFilter("women", QueryBuilders.termQuery("gender", "female")));

使用

import org.elasticsearch.search.aggregations.bucket.filters.Filters;

// sr is here your SearchResponse object

Filters agg = sr.getAggregations().get("agg");

// For each entry

for (Filters.Bucket entry : agg.getBuckets()) {

    String key = entry.getKeyAsString();            // bucket key

    long docCount = entry.getDocCount();            // Doc count

    logger.info("key [{}], doc_count [{}]", key, docCount);

}

结果

key [men], doc_count [4982]

key [women], doc_count [5018]

1.4、MIssing 聚合

AggregationBuilders.missing("agg").field("gender");

使用

import org.elasticsearch.search.aggregations.bucket.missing.Missing;

// sr is here your SearchResponse object

Missing agg = sr.getAggregations().get("agg");

agg.getDocCount(); // Doc count

1.5、嵌套

AggregationBuilders.nested("agg", "resellers");

使用

import org.elasticsearch.search.aggregations.bucket.nested.Nested;

// sr is here your SearchResponse object

Nested agg = sr.getAggregations().get("agg");

agg.getDocCount(); // Doc count

1.6、反转嵌套

AggregationBuilder aggregation =

    AggregationBuilders

        .nested("agg", "resellers")

        .subAggregation(

                AggregationBuilders

                        .terms("name").field("resellers.name")

                        .subAggregation(

                                AggregationBuilders

                                        .reverseNested("reseller_to_product")

                        )

        );

使用

import org.elasticsearch.search.aggregations.bucket.nested.Nested;

import org.elasticsearch.search.aggregations.bucket.nested.ReverseNested;

import org.elasticsearch.search.aggregations.bucket.terms.Terms;

// sr is here your SearchResponse object

Nested agg = sr.getAggregations().get("agg");

Terms name = agg.getAggregations().get("name");

for (Terms.Bucket bucket : name.getBuckets()) {

    ReverseNested resellerToProduct = bucket.getAggregations().get("reseller_to_product");

    resellerToProduct.getDocCount(); // Doc count

}

1.7、子聚合

AggregationBuilder aggregation = AggregationBuilders.children("agg", "reseller");

使用

import org.elasticsearch.search.aggregations.bucket.children.Children;

// sr is here your SearchResponse object

Children agg = sr.getAggregations().get("agg");

agg.getDocCount(); // Doc count

1.8、Terms 聚合【按某个字段分组】

AggregationBuilders.terms("genders").field("gender");

使用

import org.elasticsearch.search.aggregations.bucket.terms.Terms;

// sr is here your SearchResponse object

Terms genders = sr.getAggregations().get("genders");

// For each entry

for (Terms.Bucket entry : genders.getBuckets()) {

    entry.getKey();      // Term

    entry.getDocCount(); // Doc count

}

1.9、排序【Order】

通过doc_count以递增方式对存储桶进行排序：

AggregationBuilders

    .terms("genders")

    .field("gender")

    .order(Terms.Order.count(true))

按字母顺序按顺序升序方式排序存储桶：

AggregationBuilders

    .terms("genders")

    .field("gender")

    .order(Terms.Order.term(true))

通过单值度量子聚合（由聚合名称标识）对存储桶进行排序：

AggregationBuilders

    .terms("genders")

    .field("gender")

    .order(Terms.Order.aggregation("avg_height", false))

    .subAggregation(

        AggregationBuilders.avg("avg_height").field("height")

    )

1.10、范围聚合

AggregationBuilder aggregation =

        AggregationBuilders

                .range("agg")

                .field("height")

                .addUnboundedTo(1.0f)               // from -infinity to 1.0 (excluded)

                .addRange(1.0f, 1.5f)               // from 1.0 to 1.5 (excluded)

                .addUnboundedFrom(1.5f);            // from 1.5 to +infinity

使用

import org.elasticsearch.search.aggregations.bucket.range.Range;

// sr is here your SearchResponse object

Range agg = sr.getAggregations().get("agg");

// For each entry

for (Range.Bucket entry : agg.getBuckets()) {

    String key = entry.getKeyAsString();             // Range as key

    Number from = (Number) entry.getFrom();          // Bucket from

    Number to = (Number) entry.getTo();              // Bucket to

    long docCount = entry.getDocCount();    // Doc count

    logger.info("key [{}], from [{}], to [{}], doc_count [{}]", key, from, to, docCount);

}

结果

key [*-1.0], from [-Infinity], to [1.0], doc_count [9]

key [1.0-1.5], from [1.0], to [1.5], doc_count [21]

key [1.5-*], from [1.5], to [Infinity], doc_count [20]

1.11、日期范围聚合

AggregationBuilder aggregation =

        AggregationBuilders

                .dateRange("agg")

                .field("dateOfBirth")

                .format("yyyy")

                .addUnboundedTo("1950")    // from -infinity to 1950 (excluded)

                .addRange("1950", "1960")  // from 1950 to 1960 (excluded)

                .addUnboundedFrom("1960"); // from 1960 to +infinity

使用

import org.elasticsearch.search.aggregations.bucket.range.Range;

// sr is here your SearchResponse object

Range agg = sr.getAggregations().get("agg");

// For each entry

for (Range.Bucket entry : agg.getBuckets()) {

    String key = entry.getKeyAsString();                // Date range as key

    DateTime fromAsDate = (DateTime) entry.getFrom();   // Date bucket from as a Date

    DateTime toAsDate = (DateTime) entry.getTo();       // Date bucket to as a Date

    long docCount = entry.getDocCount();                // Doc count

    logger.info("key [{}], from [{}], to [{}], doc_count [{}]", key, fromAsDate, toAsDate, docCount);

}

结果

key [*-1950], from [null], to [1950-01-01T00:00:00.000Z], doc_count [8]

key [1950-1960], from [1950-01-01T00:00:00.000Z], to [1960-01-01T00:00:00.000Z], doc_count [5]

key [1960-*], from [1960-01-01T00:00:00.000Z], to [null], doc_count [37]

更多，如significantTerms、IP范围聚合、直方图聚合、日期直方图聚合、GEO距离聚合等地址

巴特西