elasticsearch - Multiple Non-Nested Aggregations -
is there way multiple non nested aggregations on fields in elastic search? of aggregations child or parent, on same level.
{ "size": 0, "aggs": { "one": { "terms": { "field": "a" }, "aggs": { "two": { "terms": { "field": "b" }, "aggs": { "three": { "terms": { "field": "c" } } } } } } } }
elasticsearch has broadly 3 types of aggregations.
bucket - allows form "buckets" of different types. terms (on not_analyzed string fields), time intervals (date_histogram aggregations if data has "timestamp" type of column), geographical shapes (geo hash aggregations if data has longitude/latitude).
metric - sum, average, min, max , numerical aggregations applied within buckets or outside buckets (at top level)
pipeline - experimental. feed output of 1 aggregation another.
you can have multiple bucket aggregations on same level (either top level "aggs" element or nested "aggs" inside other bucket aggregation). can nest bucket aggregations inside each other.
for metric aggregations, can have them on top level "aggs" element or inside bucket aggregation.
in example, if a, b , c of string type , not_analyzed fields. can bucket aggregations like.
{ "size": 0, "aggs": { "one": { "terms": { "field": "a" }, "aggs": { "two": { "terms": { "field": "b" } } } }, "aggs": { "three": { "terms": { "field": "c" } } } } }
"one" , "three" term aggregations on top level. "two" nested inside "one".
if, additionally had numeric fields in document. example d , e. want compute sum of d's within each bucket of , each bucket of b, sum of e within each bucket of b. sum of d within each bucket of c. can of them simultaneously in 1 query, in single pass...
{ "size": 0, "aggs": { "one": { "terms": { "field": "a" }, "aggs": { "sumofdwithina": { "sum": { "field": "d" } }, "two": { "terms": { "field": "b" }, "aggs": { "sumofdwithinb": { "sum": { "field": "d" } }, "sumofewithinb": { "sum": { "field": "e" } } } } } }, "aggs": { "three": { "terms": { "field": "c" }, "aggs": { "sumofdwithinc": { "sum": { "field": "d" } } } } } } }
Comments
Post a Comment