elasticsearch 嵌套聚合ElasticSearch的问题：在最大值之后求和

我知道使用度量聚合不可能实现子聚合，Elasticsearch支持使用bucket的子聚合。但是我有点不知道怎么做

我想在嵌套聚合和按最大时间戳聚合之后进行求和

类似下面的代码，给我这个错误：“[max]类型的聚合器[max\u date\u aggs]不能接受子聚合”，这是正常的。有没有办法让它起作用

{
"aggs": {
    "sender_comp_aggs": {
        "terms": {
            "field": "senderComponent"
        },
        "aggs": {
            "activity_mnemo_aggs": {
                "terms": {
                    "field": "activityMnemo"
                },
                "aggs": {
                    "activity_instance_id_aggs": {
                        "terms": {
                            "field": "activityInstanceId"
                        },
                        "aggs": {
                            "business_date_aggs": {
                                "terms": {
                                    "field": "correlationIdSet.businessDate"
                                },
                                "aggs": {
                                    "context_set_id_closing_aggs": {
                                        "terms": {
                                            "field": "contextSetId.closing"
                                        },
                                        "aggs": {
                                            "max_date_aggs": {
                                                "max": {
                                                    "field": "timestamp"
                                                },
                                                "aggs" : {
                                                    "sum_done": {
                                                        "sum": {
                                                            "field": "itemNumberDone"
                                                        }
                                                    }
                                                }
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }

---

谢谢你

我不是100%确定你想要实现什么，如果你也愿意分享映射，那会有所帮助

bucket聚合是关于定义bucket/组的。正如您在示例中所做的，您可以包装/嵌套bucket聚合，以进一步将bucket分解为子bucket，以此类推

默认情况下，Elasticsearch始终计算计数度量，但您也可以指定要计算的其他度量。度量是按每个bucket/为一个bucket（而不是另一个度量）计算的。这就是为什么不能在度量聚合下嵌套度量聚合，这根本没有意义

根据数据的外观，您可能需要做的唯一更改是将

sum\u done

聚合从

aggs

-子句中移出，移动到与

max\u date\u aggs

-聚合相同的级别

代码片段

"aggs": {
  "max_date_aggs": { "max": {"field": "timestamp"} },
  "sum_done": { "sum": { "field": "itemNumberDone"} }
}

在您完善了您的问题并提供了解决方案后，我设法提出了一个只需一个请求的解决方案。如前所述，

sum

-度量聚合需要在bucket而不是度量上操作。解决方案非常简单：与其计算

max

-date，不如将此聚合重新表述为

terms

-aggregation，按降序时间戳排序，只要求一个bucket

解决方案

GET gos_element/_search
{
  "size": 0, 
  "aggs": {
    "sender_comp_aggs": {
      "terms": {"field": "senderComponent.keyword"},
      "aggs": {
        "activity_mnemo_aggs": {
          "terms": {"field": "activityMnemo.keyword"},
          "aggs": {
            "activity_instance_id_aggs": {
              "terms": {"field": "activityInstanceId.keyword"},
              "aggs": {
                "business_date_aggs": {
                  "terms": {"field": "correlationIdSet.businessDate"},
                  "aggs": {
                    "context_set_id_closing_aggs": {
                      "terms": {"field": "contextSetId.closing.keyword"},
                      "aggs": {
                        "max_date_bucket_aggs": {
                          "terms": {
                            "field": "timestamp",
                            "size": 1, 
                            "order": {"_key": "desc"} 
                          },
                          "aggs": {
                            "sum_done": {
                              "sum": {"field": "itemNumberDone"}
                            }
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

由于我依赖于默认的Elasticsearch映射，因此我必须参考字段的

.keyword

-版本。如果您的字段直接映射到类型为

关键字

的字段，则不需要这样做

在使用以下2个命令为您提供的文档编制索引后，您可以立即测试上述请求：

PUT gos_element/_doc/AW_yu3dIa2R_HwqpSz
{
  "senderComponent": "PS",
  "timestamp": "2020-01-28T02:31:00Z",
  "activityMnemo": "PScommand",
  "activityInstanceId": "123466",
  "activityStatus": "Progress",
  "activityStatusNumber": 300,
  "specificActivityStatus": "",
  "itemNumberTotal": 10,
  "itemNumberDone": 9,
  "itemNumberInError": 0,
  "itemNumberNotStarted": 1,
  "itemNumberInProgress": 0,
  "itemUnit": "Command",
  "itemList": [],
  "contextSetId": {
    "PV": "VAR",
    "closing": "PARIS"
  },
  "correlationIdSet": {
    "closing": "PARIS",
    "businessDate": "2020-01-27",
    "correlationId": "54947df8-0e9e-4471-a2f9-9af509fb5899"
  },
  "errorSet": [],
  "kpiSet": "",
  "activitySpecificPayload": "",
  "messageGroupUUID": "54947df8-0e9e-4471-a2f9-9af509fb5899"
}


PUT gos_element/_doc/AW_yu3dIa2R_HwqpSz8z
{
  "senderComponent": "PS",
  "timestamp": "2020-01-28T03:01:00Z",
  "activityMnemo": "PScommand",
  "activityInstanceId": "123466",
  "activityStatus": "End",
  "activityStatusNumber": 200,
  "specificActivityStatus": "",
  "itemNumberTotal": 10,
  "itemNumberDone": 10,
  "itemNumberInError": 0,
  "itemNumberNotStarted": 0,
  "itemNumberInProgress": 0,
  "itemUnit": "Command",
  "itemList": [],
  "contextSetId": {
    "PV": "VAR",
    "closing": "PARIS"
  },
  "correlationIdSet": {
    "closing": "PARIS",
    "businessDate": "2020-01-27",
    "correlationId": "54947df8-0e9e-4471-a2f9-9af509fb5899"
  },
  "errorSet": [],
  "errorMessages": "",
  "kpiSet": "",
  "activitySpecificPayload": "",
  "messageGroupUUID": "54947df8-0e9e-4471-a2f9-9af509fb5899"
}

因此，您将返回以下响应（预期值为10）：

---

以下是两份文件：

{
        "_type": "gos_element",
        "_id": "AW_yu3dIa2R_HwqpSz-o",
        "_score": 5.785128,
        "_source": {
          "senderComponent": "PS",
          "timestamp": "2020-01-28T02:31:00Z",
          "activityMnemo": "PScommand",
          "activityInstanceId": "123466",
          "activityStatus": "Progress",
          "activityStatusNumber": 300,
          "specificActivityStatus": "",
          "itemNumberTotal": 10,
          "itemNumberDone": 9,
          "itemNumberInError": 0,
          "itemNumberNotStarted": 1,
          "itemNumberInProgress": 0,
          "itemUnit": "Command",
          "itemList": [],
          "contextSetId": {
            "PV": "VAR",
            "closing": "PARIS"
          },
          "correlationIdSet": {
            "closing": "PARIS",
            "businessDate": "2020-01-27",
            "correlationId": "54947df8-0e9e-4471-a2f9-9af509fb5899"
          },
          "errorSet": [],
          "kpiSet": "",
          "activitySpecificPayload": "",
          "messageGroupUUID": "54947df8-0e9e-4471-a2f9-9af509fb5899"
        }
      },
      {
        "_type": "gos_element",
        "_id": "AW_yu3dIa2R_HwqpSz8z",
        "_score": 4.8696175,
        "_source": {
          "senderComponent": "PS",
          "timestamp": "2020-01-28T03:01:00Z",
          "activityMnemo": "PScommand",
          "activityInstanceId": "123466",
          "activityStatus": "End",
          "activityStatusNumber": 200,
          "specificActivityStatus": "",
          "itemNumberTotal": 10,
          "itemNumberDone": 10,
          "itemNumberInError": 0,
          "itemNumberNotStarted": 0,
          "itemNumberInProgress": 0,
          "itemUnit": "Command",
          "itemList": [],
          "contextSetId": {
            "PV": "VAR",
            "closing": "PARIS"
          },
          "correlationIdSet": {
            "closing": "PARIS",
            "businessDate": "2020-01-27",
            "correlationId": "54947df8-0e9e-4471-a2f9-9af509fb5899"
          },
          "errorSet": [],
          "errorMessages": "",
          "kpiSet": "",
          "activitySpecificPayload": "",
          "messageGroupUUID": "54947df8-0e9e-4471-a2f9-9af509fb5899"
        }
      }
    ]
  }

我想聚合几个术语（senderComponent、ActivityNemo、activityInstanceId、correlationIdSet.businessDate和contextSetId.closing），并聚合每个聚合的最大时间戳。完成后，我想对ItemNumberOne求和

如果我们只取这两个文档并进行聚合，我想得到10个ItemNumberOne

---

只需要一个查询和使用bucket就可以了吗？

您好，首先感谢您的快速回复！我尝试将完成的总和移动到与最大日期聚合相同的级别。它显示所有已完成项的总和，而不是具有最大时间戳的已完成项的总和。我还尝试使用bucket，但我不知道如何获得字段itemNumberDone的总和。我会马上补充更多细节。哦，你想要实现的是完全不同的东西。您需要有一个bucket/scope，其中包含以该max_date为值的所有文档。最有可能的是，您必须在应用程序端解决此问题：-第一个请求：查询Elasticsearch以了解最长日期。-第二个请求：使用过滤器聚合，将各个最长日期作为过滤器，以获得创建的存储桶，然后您可以向Elasticsearc索要此存储桶中文档的总和。我可能想重新考虑一下您的数据模型，因为您已经有这么多嵌套聚合了。我尝试了Bucket，但不知道如何检索ItemNumberOne，然后对其求和。当你说“在应用程序端”时，我会给你映射和进一步的细节。你的意思是创建一个进行重新请求的后端？我想这样做，只有一个查询，没有后端-如果可能的话-谢谢你，它的工作！我用“\u term”替换了“\u key”，效果很好。

{
        "_type": "gos_element",
        "_id": "AW_yu3dIa2R_HwqpSz-o",
        "_score": 5.785128,
        "_source": {
          "senderComponent": "PS",
          "timestamp": "2020-01-28T02:31:00Z",
          "activityMnemo": "PScommand",
          "activityInstanceId": "123466",
          "activityStatus": "Progress",
          "activityStatusNumber": 300,
          "specificActivityStatus": "",
          "itemNumberTotal": 10,
          "itemNumberDone": 9,
          "itemNumberInError": 0,
          "itemNumberNotStarted": 1,
          "itemNumberInProgress": 0,
          "itemUnit": "Command",
          "itemList": [],
          "contextSetId": {
            "PV": "VAR",
            "closing": "PARIS"
          },
          "correlationIdSet": {
            "closing": "PARIS",
            "businessDate": "2020-01-27",
            "correlationId": "54947df8-0e9e-4471-a2f9-9af509fb5899"
          },
          "errorSet": [],
          "kpiSet": "",
          "activitySpecificPayload": "",
          "messageGroupUUID": "54947df8-0e9e-4471-a2f9-9af509fb5899"
        }
      },
      {
        "_type": "gos_element",
        "_id": "AW_yu3dIa2R_HwqpSz8z",
        "_score": 4.8696175,
        "_source": {
          "senderComponent": "PS",
          "timestamp": "2020-01-28T03:01:00Z",
          "activityMnemo": "PScommand",
          "activityInstanceId": "123466",
          "activityStatus": "End",
          "activityStatusNumber": 200,
          "specificActivityStatus": "",
          "itemNumberTotal": 10,
          "itemNumberDone": 10,
          "itemNumberInError": 0,
          "itemNumberNotStarted": 0,
          "itemNumberInProgress": 0,
          "itemUnit": "Command",
          "itemList": [],
          "contextSetId": {
            "PV": "VAR",
            "closing": "PARIS"
          },
          "correlationIdSet": {
            "closing": "PARIS",
            "businessDate": "2020-01-27",
            "correlationId": "54947df8-0e9e-4471-a2f9-9af509fb5899"
          },
          "errorSet": [],
          "errorMessages": "",
          "kpiSet": "",
          "activitySpecificPayload": "",
          "messageGroupUUID": "54947df8-0e9e-4471-a2f9-9af509fb5899"
        }
      }
    ]
  }