Elasticsearch 之(6)kibana嵌套聚合,下钻分析,聚合分析
北京 小李
北京 小王
上海 小张
上海 小丽
上海 小陈
基于city划分buckets
划分出来两个bucket,一个是北京bucket,一个是上海bucket
北京bucket:包含了2个人,小李,小王
上海bucket:包含了3个人,小张,小丽,小陈
按照某个字段进行bucket划分,那个字段的值相同的那些数据,就会被划分到一个bucket中
有一些mysql的sql知识的话,聚合,首先第一步就是分组,对每个组内的数据进行聚合分析,分组,就是我们的bucket
metric:对一个数据分组执行的统计
当我们有了一堆bucket之后,就可以对每个bucket中的数据进行聚合分词了,比如说计算一个bucket内所有数据的数量,或者计算一个bucket内所有数据的平均值,最大值,最小值
bucket:group by user_id --> 那些user_id相同的数据,就会被划分到一个bucket中
metric,就是对一个bucket执行的某种聚合分析的操作,比如说求平均值,求最大值,求最小值
GET /ecommerce/product/_search
{"size" : 0, "aggs": {"group_by_tags": {"terms": { "field": "tags" }}}
}
aggs:固定语法,要对一份数据执行分组聚合操作
gourp_by_tags:就是对每个aggs,都要起一个名字,这个名字是随机的,你随便取什么都ok
terms:根据字段的值进行分组
field:根据指定的字段的值进行分组将文本
PUT /ecommerce/_mapping/product{"properties": {"tags": {"type": "text","fielddata": true}}
}
GET /ecommerce/product/_search
{"size": 0,"aggs": {"all_tags": {"terms": { "field": "tags" }}}
}{"took": 20,"timed_out": false,"_shards": {"total": 5,"successful": 5,"failed": 0},"hits": {"total": 4,"max_score": 0,"hits": []},"aggregations": {"group_by_tags": {"doc_count_error_upper_bound": 0,"sum_other_doc_count": 0,"buckets": [{"key": "fangzhu","doc_count": 2},{"key": "meibai","doc_count": 2},{"key": "qingxin","doc_count": 1}]}}
}
aggregations:聚合结果
gourp_by_tags:我们指定的某个聚合的名称
buckets:根据我们指定的field划分出的buckets
key:每个bucket对应的那个值
doc_count:这个bucket分组内,有多少个数据
每种tag对应的bucket中的数据的
默认的排序规则:按照doc_count降序排序
GET /ecommerce/product/_search
{"size": 0,"query": {"match": {"name": "yagao"}},"aggs": {"all_tags": {"terms": {"field": "tags"}}}
}
{"took": 35,"timed_out": false,"_shards": {"total": 5,"successful": 5,"failed": 0},"hits": {"total": 3,"max_score": 0,"hits": []},"aggregations": {"all_tags": {"doc_count_error_upper_bound": 0,"sum_other_doc_count": 0,"buckets": [{"key": "fangzhu","doc_count": 2},{"key": "meibai","doc_count": 1},{"key": "qingxin","doc_count": 1}]}}
}
top_hits 获取前几个doc_
GET /ecommerce/product/_search
{"size": 0,"aggs" : {"group_by_tags" : {"terms" : { "field" : "tags" },"aggs" : {"top_tags": {"top_hits": { "_source": {"include": "name"}, "size": 1}} }}}
}
avg:avg aggs,求平均值
max:求一个bucket内,指定field值最大的那个数据
min:求一个bucket内,指定field值最小的那个数据
sum:求一个bucket内,指定field值的总和先分组,再算每组的平均值
GET /ecommerce/product/_search
{"size": 0,"aggs" : {"group_by_tags" : {"terms" : { "field" : "tags" },"aggs" : {"avg_price": { "avg": { "field": "price" } },"min_price" : { "min": { "field": "price"} }, "max_price" : { "max": { "field": "price"} },"sum_price" : { "sum": { "field": "price" } } }}}
value:我们的metric计算的结果,每个bucket中的数据的price字段求平均值后的结果
{"took": 3,"timed_out": false,"_shards": {"total": 5,"successful": 5,"failed": 0},"hits": {"total": 3,"max_score": 0,"hits": []},"aggregations": {"group_by_tags": {"doc_count_error_upper_bound": 0,"sum_other_doc_count": 0,"buckets": [{"key": "fangzhu","doc_count": 2,"max_price": {"value": 30},"min_price": {"value": 25},"avg_price": {"value": 27.5},"sum_price": {"value": 55}},{"key": "meibai","doc_count": 1,"max_price": {"value": 30},"min_price": {"value": 30},"avg_price": {"value": 30},"sum_price": {"value": 30}},{"key": "qingxin","doc_count": 1,"max_price": {"value": 40},"min_price": {"value": 40},"avg_price": {"value": 40},"sum_price": {"value": 40}}]}}
}
collect_mode
对于子聚合的计算,有两种方式:
- depth_first 直接进行子聚合的计算
- breadth_first 先计算出当前聚合的结果,针对这个结果在对子聚合进行计算。
"order": { "avg_price": "desc" }
GET /ecommerce/product/_search
{"size": 0,"aggs" : {"all_tags" : {"terms" : { "field" : "tags", "collect_mode" : "breadth_first", "order": { "avg_price": "desc" } },"aggs" : {"avg_price" : {"avg" : { "field" : "price" }}}}}
}
{"took": 2,"timed_out": false,"_shards": {"total": 5,"successful": 5,"failed": 0},"hits": {"total": 3,"max_score": 0,"hits": []},"aggregations": {"all_tags": {"doc_count_error_upper_bound": 0,"sum_other_doc_count": 0,"buckets": [{"key": "qingxin","doc_count": 1,"avg_price": {"value": 40}},{"key": "meibai","doc_count": 1,"avg_price": {"value": 30}},{"key": "fangzhu","doc_count": 2,"avg_price": {"value": 27.5}}]}}
}
" ranges ": [{},{}]
GET /ecommerce/product/_search
{"size": 0,"aggs": {"group_by_price": {"range": {"field": "price","ranges": [{"from": 0,"to": 20},{"from": 20,"to": 40},{"from": 40,"to": 50}]},"aggs": {"group_by_tags": {"terms": {"field": "tags"},"aggs": {"average_price": {"avg": {"field": "price"}}}}}}}
}
histogram
interval:10,划分范围,0~10,10~20,20~30
GET /ecommerce/product/_search
{"size" : 0,"aggs":{"price":{"histogram":{ "field": "price","interval": 10},"aggs":{"revenue": {"sum": { "field" : "price"}}}}}
}
{"took": 1,"timed_out": false,"_shards": {"total": 5,"successful": 5,"failed": 0},"hits": {"total": 3,"max_score": 0,"hits": []},"aggregations": {"price": {"buckets": [{"key": 20,"doc_count": 1,"revenue": {"value": 25}},{"key": 30,"doc_count": 1,"revenue": {"value": 30}},{"key": 40,"doc_count": 1,"revenue": {"value": 40}}]}}
}
date interval = 1m,
2017-01-01~2017-01-31,就是一个bucket
2017-02-01~2017-02-28,就是一个bucket
然后会去扫描每个数据的date field,判断date落在哪个bucket中,就将其放入那个bucket
min_doc_count:即使某个日期interval,2017-01-01~2017-01-31中,一条数据都没有,那么这个区间也是要返回的,不然默认是会过滤掉这个区间的
extended_bounds,min,max:划分bucket的时候,会限定在这个起始日期,和截止日期内
GET /tvs/sales/_search
{"size" : 0,"aggs": {"sales": {"date_histogram": {"field": "sold_date","interval": "month", "format": "yyyy-MM-dd","min_doc_count" : 0, "extended_bounds" : { "min" : "2016-01-01","max" : "2017-12-31"}}}}
}
{"took": 11,"timed_out": false,"_shards": {"total": 5,"successful": 5,"failed": 0},"hits": {"total": 8,"max_score": 0,"hits": []},"aggregations": {"sales": {"buckets": [{"key_as_string": "2016-01-01","key": 1451606400000,"doc_count": 0},{"key_as_string": "2016-02-01","key": 1454284800000,"doc_count": 0},{"key_as_string": "2016-03-01","key": 1456790400000,"doc_count": 0},{"key_as_string": "2016-04-01","key": 1459468800000,"doc_count": 0},{"key_as_string": "2016-05-01","key": 1462060800000,"doc_count": 1},.....]}}
}
aggregation,scope,一个聚合操作,必须在query的搜索结果范围内执行
出来两个结果,一个结果,是基于query搜索结果来聚合的; 一个结果,是对所有数据执行聚合的
global
就是global bucket,就是将所有数据纳入聚合的scope,而不管之前的query
GET /tvs/sales/_search
{"size": 0, "query": {"term": {"brand": {"value": "长虹"}}},"aggs": {"single_brand_avg_price": {"avg": {"field": "price"}},"all": {"global": {},"aggs": {"all_brand_avg_price": {"avg": {"field": "price"}}}}}
}
{"took": 4,"timed_out": false,"_shards": {"total": 5,"successful": 5,"failed": 0},"hits": {"total": 3,"max_score": 0,"hits": []},"aggregations": {"all": {"doc_count": 8,"all_brand_avg_price": {"value": 2650}},"single_brand_avg_price": {"value": 1666.6666666666667}}
}
single_brand_avg_price:就是针对query搜索结果,执行的,拿到的,就是长虹品牌的平均价格
all.all_brand_avg_price:拿到所有品牌的平均价格
Elasticsearch 之(6)kibana嵌套聚合,下钻分析,聚合分析相关推荐
- Elasticsearch分析聚合
Elasticsearch不仅仅适合做全文检索,分析聚合功能也很好用.下面通过实例来学习. 一.准备数据 {"index":{ "_index": " ...
- Elasticsearch实战(十三)---聚合搜索Aggs聚合及Count,Avg操作
Elasticsearch实战- 聚合搜索Aggs聚合及Count,Avg操作 文章目录 Elasticsearch实战- 聚合搜索Aggs聚合及Count,Avg操作 1.聚合搜索 bucket 桶 ...
- Elasticsearch(三)——Es搜索(简单使用、全文查询、复合查询)、地理位置查询、特殊查询、聚合操作、桶聚合、管道聚合
Elasticsearch(三)--Es搜索(简单使用.全文查询.复合查询).地理位置查询.特殊查询.聚合操作.桶聚合.管道聚合 一.Es搜索 这里的 Es 数据博主自己上网找的,为了练习 Es 搜索 ...
- ElasticSearch学习之Kibana(一)
文章目录 前言 安装elasticsearch elasticsearch基础 定义 基础 安装Kibana 安装 查看服务状态 Kibana索引管理 增加索引(数据库) 获取索引(数据库) 删除索引 ...
- ELK——ElasticSearch(ES) LogStash Kibana 范围查询 经纬度
Spring Boot 搭建 ELK,这才是正确看日志的方式! ES地理边界聚合官网 ES API官网 一.快速入门实战 二.核心语法集群高可用实战演练 三.集群架构原理与搜索技术深入 四.底层原理与 ...
- Elasticsearch入门、Kibana 索引管理(elasticserch-head 插件使用, Kibanan 安装和使用)
目录 一.搜索的介绍 二.全文检索的介绍 三.ELK日志协议栈 1.ELK协议栈基本介绍 四.Elasticsearch介绍 1.什么是ElasticSearch 2.ElasticSearch使用案 ...
- ElasticSearch 及其客户端 Kibana 的使用
目录 全文检索 什么是全文检索 全文检索流程 相关概念 索引库 document对象 field对象 term对象 ElasticSearch简介 什么是ElasticSearch ElasticSe ...
- 在Elasticsearch中对 text 类型的字段进行聚合异常Fielddata is disabled,Set fielddata=true
在Elasticsearch中对 text 类型的字段进行聚合异常Fielddata is disabled,Set fielddata=true 参考文章: (1)在Elasticsearch中对 ...
- elasticsearch(7)聚合统计-分组聚合
原文:https://blog.csdn.net/sz85850597/article/details/82858831 elasticsearch(7)聚合统计-分组聚合 2018年09月26日 2 ...
- (转)Elasticsearch 聚合查询、桶聚合、管道聚合及复合查询
转自: https://blog.csdn.net/zx711166/article/details/81906881 聚合查询 聚合是一种基于查询条件对数据进行分桶.计算的方法. 聚合可以嵌套,由此 ...
最新文章
- utf8 连接 mysql_mysql配置为支持utf8的连接方式只要改client就可以了吗
- JAVA的输入输出基本操作样例
- GitHub免费支持CI/CD了,开发测试部署高度自动化,支持各种语言,网友:第三方凉凉...
- 字符串中 去掉字符串前后空格以、'\t'(tab) C函数实现,附sscanf正则方式
- C#之windows桌面软件第三课:完整的串口调试助手
- SAP Spartacus中使用到的Angular ModuleWithProviders类型
- Linux下安装zookeeper集群(奇数个)
- ReportLab for PDF
- linux知识点查阅
- jquery源码分析(四)——回调对象 Callbacks
- html新建盒子,html+css 盒子模式展示(备查)
- c#string类型探讨
- 【超详细】| 使用Vmware 安装win7虚拟机
- Unity5.0 Shader 极简入门(一)
- 08年度的佳作——《真・恋姫†無双》玩后感(蜀国篇)+AGTH真正提取大法
- 马踏棋盘问题(C++版)
- MACOS系统镜像与重装
- 超详细Docker部署SpringBoot+Vue项目(三更博客项目部署)
- centos 7安装部署 单节点 Elasticsearch 6.6.0
- Swagger生成接口文档
热门文章
- 宝塔nginx自编译云锁web防护教程
- 内存颗粒位宽和容量_【存储器】浅谈SDRAM内存芯片位宽
- mysql根据出生日期统计各年龄段男女人数
- vue 中click.stop的用法
- Spark 小文件合并优化实践
- 《Two-Archive Evolutionary Algorithm for Constrained Multiobjective Optimization》阅读笔记
- 7z文件格式及其源码的分析(三)
- 改善网页性能的5种方法
- 香槟分校计算机专业毕业生去向,数据会告诉你 伊利诺伊大学香槟分校计算机系有多可怕...
- gpio_desc()的分析