其他聚合结果上的 elasticsearch min 和 max aggs

Question

我试图在 elasticsearch 中找到聚合结果的最小值和最大值。什么查询将允许它首先按字段聚合，然后执行每月子聚合以获取该字段的每月数据，然后在这些每月计算的指标中找到最小值和最大值。我一直在寻找min和max。对于下面的其余要求是我的查询

这个问题可以表述为：任何国家的最大和最小交易（考虑所有月份）是多少？ 这是我尝试过的查询：

{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "Id": "7466swy7893jgs225"
          }
        }
      ]
    }
  },
  "aggs": {
    "dimension": {
      "terms": {
        "field": "country"
      },
      "aggs": {
        "MoM": {
          "date_histogram": {
            "field": "date",
            "interval": "month",
            "format": "MMM YY"
          },
          "aggs": {
            "totalValue": {
              "sum": {
                "field": "Transactions"
              }
            }
          }
        }
      }
    }
  },
  "size": 0

}

这是我得到的输出：

   {
    "aggregations": {
    "dimension": {
    "doc_count_error_upper_bound": 0,
    "sum_other_doc_count": 0,
    "buckets": [
    {
        "key": "USA",
        "doc_count": 392,
        "MoM": {
            "buckets": [
            {
            "key_as_string": "jan 16",
            "key": 1462060800000,
            "doc_count": 31,
            "totalValue": { "value": 352 }
            },
            {
            "key_as_string": "Feb 16",
            "key": 1462060800000,
            "doc_count": 31,
            "totalValue": { "value": 429 }
            }
         ??????????????/MIN and MAX of 352 AND 429
          ]
        }
    },
    {
        "key": "Bhutan",
        "doc_count": 392,
        "MoM": {
            "buckets": [
            {
            "key_as_string": "Jan 16",
            "key": 1462060800000,
            "doc_count": 31,
            "totalValue": {"value": 750 }
            }
            ,
            {
            "key_as_string": "Feb 16",
            "key": 1464739200000,
            "doc_count": 30,
            "totalValue": {"value": 827 }
        }
          ??????????????/MIN and MAX of 750 AND 827

      ]
     }
  }
 ]
 }
 }}

Answer 1

您需要使用管道聚合。. 尝试Max Bucket和Min Bucket聚合

{
"size": 0,
"aggs": {
  "dimension": {
     "terms": {
        "field": "country"
     },
     "aggs": {
        "MoM": {
           "date_histogram": {
              "field": "date",
              "interval": "month",
              "format": "MMM YY"
           },
           "aggs": {
              "totalValue": {
                 "sum": {
                    "field": "transactions"
                 }
              }
           }
        },
        "max_monthly_temp": {
           "max_bucket": {
              "buckets_path": "MoM>totalValue"
           }
        },
        "min_monthly_temp": {
           "min_bucket": {
              "buckets_path": "MoM>totalValue"
              }
            }
         }
      }
   }
 }

输出将有点像：

 "buckets": [
        {
           "key": "India",
           "doc_count": 5,
           "MoM": {
              "buckets": [
                 {
                    "key_as_string": "Feb 17",
                    "key": 1485907200000,
                    "doc_count": 3,
                    "totalValue": {
                       "value": 260
                    }
                 },
                 {
                    "key_as_string": "Mar 17",
                    "key": 1488326400000,
                    "doc_count": 1,
                    "totalValue": {
                       "value": 115
                    }
                 },
                 {
                    "key_as_string": "Apr 17",
                    "key": 1491004800000,
                    "doc_count": 1,
                    "totalValue": {
                       "value": 5
                    }
                 }
              ]
           },
           "max_monthly_temp": {
              "value": 260,
              "keys": [
                 "Feb 17"
              ]
           },
           "min_monthly_temp": {
              "value": 5,
              "keys": [
                 "Apr 17"
              ]
           }
        },
    ......
      ]

希望这可以帮助..