elastic search es 分组统计 aggs 次数用法

骑猪看日落 2022-11-19 13:56 175阅读 0赞

参考链接:[https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations.html][https_www.elastic.co_guide_en_elasticsearch_reference_current_search-aggregations.html]

es 各个版本的语法可能会不一样，如果大家在用的时候发现语法报错了，请查阅相关版本的语法。

刚需要按 ip 地址统计某个接口的访问次数，查了下 es 分组统计次数 aggs 的用法，特此记录一下，方便下次查阅。

GET filebeat-7.2.0-2021.01.07/doc/_search?size=0
    { 
      "query": { 
        "bool": { 
          "must": [
            { 
              "match": { 
                "uripath": "url"
              }
            }
          ]
        }
      },
      "aggs": { 
        "my-agg-name": { 
          "terms": { 
            "field": "remote_addr"
          }
        }
      }
    }

my-agg-name 可以随便命名，不改也行。  
terms 、field 不需要改，需要改的是 remote\_addr ，按实际的字段名称修改即可。

返回结果:

{ 
      "took" : 1209,
      "timed_out" : false,
      "_shards" : { 
        "total" : 1,
        "successful" : 1,
        "skipped" : 0,
        "failed" : 0
      },
      "hits" : { 
        "total" : 98605,
        "max_score" : 0.0,
        "hits" : [ ]
      },
      "aggregations" : { 
        "my-agg-name" : { 
          "doc_count_error_upper_bound" : 0,
          "sum_other_doc_count" : 819,
          "buckets" : [
            { 
              "key" : "ip1",
              "doc_count" : 42067
            },
            { 
              "key" : "ip2",
              "doc_count" : 24665
            },
            { 
              "key" : "ip3",
              "doc_count" : 24637
            },
            { 
              "key" : "ip4",
              "doc_count" : 1703
            },
            { 
              "key" : "ip5",
              "doc_count" : 1456
            },
            { 
              "key" : "ip6",
              "doc_count" : 1438
            },
            { 
              "key" : "ip7",
              "doc_count" : 561
            },
            { 
              "key" : "ip8",
              "doc_count" : 496
            },
            { 
              "key" : "ip9",
              "doc_count" : 445
            },
            { 
              "key" : "ip10",
              "doc_count" : 318
            }
          ]
        }
      }
    }

[https_www.elastic.co_guide_en_elasticsearch_reference_current_search-aggregations.html]: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations.html