Elasticsearch入门（三）高级查询操作

前期准备

先把上一个内容的 student索引删除掉

在 Postman 中，向 ES 服务器发 DELETE请求：http://127.0.0.1:9200/student

在 Postman 中，向 ES 服务器发五个 POST 请求：http://127.0.0.1:9200/student/_doc/100x

x分别是1，2，3，4，5，6,每次请求携带自己的请求体，请求体内容在下方代码块里

1. {
2. "name":"zhangsan",
3. "nickname":"zhangsan",
4. "sex":"男",
5. "age":30
6. }
7. {
8. "name":"lisi",
9. "nickname":"lisi",
10. "sex":"男",
11. "age":20
12. }
13. {
14. "name":"wangwu",
15. "nickname":"wangwu",
16. "sex":"女",
17. "age":40
18. }
19. {
20. "name":"zhangsan1",
21. "nickname":"zhangsan1",
22. "sex":"女",
23. "age":50
24. }
25. {
26. "name":"zhangsan2",
27. "nickname":"zhangsan2",
28. "sex":"女",
29. "age":30
30. }
31. {
32. "name":"zhangsan222",
33. "nickname":"zhangsan222",
34. "sex":"女",
35. "age":30
36. }

高级查询

本内容基本都是对请求体进行配置，也是 ElasticSearch 的语法核心所在。查询都是用 GET 请求。

1. 查询所有文档

http://127.0.0.1:9200/student/_search

请求体内容：

1. {
2. "query": {
3. "match_all": {}
4. }
5. }
6. # "query"：这里的 query 代表一个查询对象，里面可以有不同的查询属性
7. # "match_all"：查询类型，例如：match_all(代表查询所有)，match，term，range 等等
8. # {查询条件}：查询条件会根据类型的不同，写法也有差异

结果：

1. {
2. "took": 1,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 6,
13. "relation": "eq"
14. },
15. "max_score": 1.0,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1001",
21. "_score": 1.0,
22. "_source": {
23. "name": "zhangsan",
24. "nickname": "zhangsan",
25. "sex": "男",
26. "age": 30
27. }
28. },
29. {
30. "_index": "student",
31. "_type": "_doc",
32. "_id": "1002",
33. "_score": 1.0,
34. "_source": {
35. "name": "lisi",
36. "nickname": "lisi",
37. "sex": "男",
38. "age": 20
39. }
40. },
41. {
42. "_index": "student",
43. "_type": "_doc",
44. "_id": "1003",
45. "_score": 1.0,
46. "_source": {
47. "name": "wangwu",
48. "nickname": "wangwu",
49. "sex": "女",
50. "age": 40
51. }
52. },
53. {
54. "_index": "student",
55. "_type": "_doc",
56. "_id": "1004",
57. "_score": 1.0,
58. "_source": {
59. "name": "zhangsan1",
60. "nickname": "zhangsan1",
61. "sex": "女",
62. "age": 50
63. }
64. },
65. {
66. "_index": "student",
67. "_type": "_doc",
68. "_id": "1005",
69. "_score": 1.0,
70. "_source": {
71. "name": "zhangsan2",
72. "nickname": "zhangsan2",
73. "sex": "女",
74. "age": 30
75. }
76. },
77. {
78. "_index": "student",
79. "_type": "_doc",
80. "_id": "1006",
81. "_score": 1.0,
82. "_source": {
83. "name": "zhangsan222",
84. "nickname": "zhangsan222",
85. "sex": "女",
86. "age": 30
87. }
88. }
89. ]
90. }
91. }

2. 分词查询

http://127.0.0.1:9200/student/_search

请求体：

1. {
2. "query": {
3. "match": {
4. "name": "zhangsan2"
5. }
6. }
7. }

查询 name为 zhangsan2 的数据

查询结果：

1. {
2. "took": 287,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 1,
13. "relation": "eq"
14. },
15. "max_score": 1.540445,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1005",
21. "_score": 1.540445,
22. "_source": {
23. "name": "zhangsan2",
24. "nickname": "zhangsan2",
25. "sex": "女",
26. "age": 30
27. }
28. }
29. ]
30. }
31. }

3. 字段匹配查询

匹配查询用到 multi_match

multi_match 与 match 类似，不同的是它可以在多个字段中查询。

http://127.0.0.1:9200/student/_search

请求体内容：

1. {
2. "query": {
3. "multi_match": {
4. "query": "zhangsan",
5. "fields": ["name","nickname"]
6. }
7. }
8. }

查询 key 为 name 和 nickname，value 为 zhangsan 的数据

结果

1. {
2. "took": 52,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 1,
13. "relation": "eq"
14. },
15. "max_score": 1.540445,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1001",
21. "_score": 1.540445,
22. "_source": {
23. "name": "zhangsan",
24. "nickname": "zhangsan",
25. "sex": "男",
26. "age": 30
27. }
28. }
29. ]
30. }
31. }

4. 单关键字精确查询

term查询，精确的关键词匹配查询，不对查询条件进行分词，即只能单关键字精确查询。

http://127.0.0.1:9200/student/_search

请求体内容：

1. {
2. "query": {
3. "term": {
4. "name": {
5. "value": "zhangsan"
6. }
7. }
8. }
9. }

查询 key 为 name，value 为 zhangsan的数据

结果

1. {
2. "took": 4,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 1,
13. "relation": "eq"
14. },
15. "max_score": 1.540445,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1001",
21. "_score": 1.540445,
22. "_source": {
23. "name": "zhangsan",
24. "nickname": "zhangsan",
25. "sex": "男",
26. "age": 30
27. }
28. }
29. ]
30. }
31. }

5. 多关键字精确查询

terms 查询和 term 查询一样，但它允许你指定多值进行匹配。

如果这个字段包含了指定值中的任何一个值，那么这个文档满足条件，类似于 mysql 的 in 在

http://127.0.0.1:9200/student/_search

1. {
2. "query": {
3. "terms": {
4. "name": ["zhangsan","lisi"]
5. }
6. }
7. }

查询 key 为 name，value 分别为 zhangsan和 lisi的数据

结果：

1. {
2. "took": 14,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 2,
13. "relation": "eq"
14. },
15. "max_score": 1.0,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1001",
21. "_score": 1.0,
22. "_source": {
23. "name": "zhangsan",
24. "nickname": "zhangsan",
25. "sex": "男",
26. "age": 30
27. }
28. },
29. {
30. "_index": "student",
31. "_type": "_doc",
32. "_id": "1002",
33. "_score": 1.0,
34. "_source": {
35. "name": "lisi",
36. "nickname": "lisi",
37. "sex": "男",
38. "age": 20
39. }
40. }
41. ]
42. }
43. }

6. 指定字段查询（指定返回结果）

默认情况下，Elasticsearch 在搜索的结果中，会把文档中保存在 _source 的所有字段都返回。

如果我们只想获取其中的部分字段，我们可以添加 _source 的过滤

http://127.0.0.1:9200/student/_search

请求体内容：

1. {
2. "_source": ["name","nickname"],
3. "query": {
4. "terms": {
5. "nickname": ["zhangsan"]
6. }
7. }
8. }

只需要查询出 key 为 name和 nickname，value 为 zhangsan的数据

结果：

1. {
2. "took": 3,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 1,
13. "relation": "eq"
14. },
15. "max_score": 1.0,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1001",
21. "_score": 1.0,
22. "_source": {
23. "name": "zhangsan",
24. "nickname": "zhangsan"
25. }
26. }
27. ]
28. }
29. }

7. 过滤字段

用到的字段：

• includes：来指定想要显示的字段
• excludes：来指定不想要显示的字段

includes 使用

http://127.0.0.1:9200/student/_search

请求体内容：

1. {
2. "_source": {
3. "includes": ["name","nickname"]
4. },
5. "query": {
6. "terms": {
7. "nickname": ["zhangsan"]
8. }
9. }
10. }

结果：

1. {
2. "took": 2,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 1,
13. "relation": "eq"
14. },
15. "max_score": 1.0,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1001",
21. "_score": 1.0,
22. "_source": {
23. "name": "zhangsan",
24. "nickname": "zhangsan"
25. }
26. }
27. ]
28. }
29. }

8. 组合查询

bool把各种其它查询通过 must（必须，类似 and）、must_not（必须不，类似 not）、should（应该 类似 or）的方式进行组合

http://127.0.0.1:9200/student/_search

请求体内容：

1. {
2. "query": {
3. "bool": {
4. "must": [
5. {
6. "match": {
7. "name": "zhangsan"
8. }
9. }
10. ],
11. "must_not": [
12. {
13. "match": {
14. "age": "40"
15. }
16. }
17. ],
18. "should": [
19. {
20. "match": {
21. "sex": "男"
22. }
23. }
24. ]
25. }
26. }
27. }

查询 name 必须为 zhangsan，age 不能是 40，sex 可以是男的数据

结果：

1. {
2. "took": 10,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 1,
13. "relation": "eq"
14. },
15. "max_score": 2.5700645,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1001",
21. "_score": 2.5700645,
22. "_source": {
23. "name": "zhangsan",
24. "nickname": "zhangsan",
25. "sex": "男",
26. "age": 30
27. }
28. }
29. ]
30. }
31. }

9. 范围查询

range 查询找出那些落在指定区间内的数字或者时间。range 查询允许以下字符

http://127.0.0.1:9200/student/_search

请求体内容：

1. {
2. "query": {
3. "range": {
4. "age": {
5. "gte": 30,
6. "lte": 35
7. }
8. }
9. }
10. }

查询年龄大于等于 30 小于等于 35 的数据

结果

1. {
2. "took": 4,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 3,
13. "relation": "eq"
14. },
15. "max_score": 1.0,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1001",
21. "_score": 1.0,
22. "_source": {
23. "name": "zhangsan",
24. "nickname": "zhangsan",
25. "sex": "男",
26. "age": 30
27. }
28. },
29. {
30. "_index": "student",
31. "_type": "_doc",
32. "_id": "1005",
33. "_score": 1.0,
34. "_source": {
35. "name": "zhangsan2",
36. "nickname": "zhangsan2",
37. "sex": "女",
38. "age": 30
39. }
40. },
41. {
42. "_index": "student",
43. "_type": "_doc",
44. "_id": "1006",
45. "_score": 1.0,
46. "_source": {
47. "name": "zhangsan222",
48. "nickname": "zhangsan222",
49. "sex": "女",
50. "age": 30
51. }
52. }
53. ]
54. }
55. }

10.模糊查询

返回包含与搜索字词相似的字词的文档。使用的字段是 fuzzy

编辑距离是将一个术语转换为另一个术语所需的一个字符更改的次数。这些更改可以包括：

• 更改字符（box → fox）
• 删除字符（black → lack）
• 插入字符（sic → sick）
• 转置两个相邻字符（act → cat）

为了找到相似的术语，fuzzy 查询会在指定的编辑距离内创建一组搜索词的所有可能的变体或扩展。然后查询返回每个扩展的完全匹配。

通过 fuzziness 修改编辑距离。一般使用默认值 AUTO，根据术语的长度生成编辑距离。

例子 1：在 Postman 中，向 ES 服务器发 GET 请求：http://127.0.0.1:9200/student/_search

请求体内容：

1. {
2. "query": {
3. "fuzzy": {
4. "name": {
5. "value": "zhangsan"
6. }
7. }
8. }
9. }

模糊查询 name 带有 zhangsan 的数据

结果

1. {
2. "took": 22,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 3,
13. "relation": "eq"
14. },
15. "max_score": 1.540445,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1001",
21. "_score": 1.540445,
22. "_source": {
23. "name": "zhangsan",
24. "nickname": "zhangsan",
25. "sex": "男",
26. "age": 30
27. }
28. },
29. {
30. "_index": "student",
31. "_type": "_doc",
32. "_id": "1004",
33. "_score": 1.3478894,
34. "_source": {
35. "name": "zhangsan1",
36. "nickname": "zhangsan1",
37. "sex": "女",
38. "age": 50
39. }
40. },
41. {
42. "_index": "student",
43. "_type": "_doc",
44. "_id": "1005",
45. "_score": 1.3478894,
46. "_source": {
47. "name": "zhangsan2",
48. "nickname": "zhangsan2",
49. "sex": "女",
50. "age": 30
51. }
52. }
53. ]
54. }
55. }

例子 2：在 Postman 中，向 ES 服务器发 GET 请求：http://127.0.0.1:9200/student/_search

请求体内容：

1. {
2. "query": {
3. "fuzzy": {
4. "name": {
5. "value": "zhangsan",
6. "fuzziness": 2
7. }
8. }
9. }
10. }

结果：

1. {
2. "took": 4,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 3,
13. "relation": "eq"
14. },
15. "max_score": 1.540445,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1001",
21. "_score": 1.540445,
22. "_source": {
23. "name": "zhangsan",
24. "nickname": "zhangsan",
25. "sex": "男",
26. "age": 30
27. }
28. },
29. {
30. "_index": "student",
31. "_type": "_doc",
32. "_id": "1004",
33. "_score": 1.3478894,
34. "_source": {
35. "name": "zhangsan1",
36. "nickname": "zhangsan1",
37. "sex": "女",
38. "age": 50
39. }
40. },
41. {
42. "_index": "student",
43. "_type": "_doc",
44. "_id": "1005",
45. "_score": 1.3478894,
46. "_source": {
47. "name": "zhangsan2",
48. "nickname": "zhangsan2",
49. "sex": "女",
50. "age": 30
51. }
52. }
53. ]
54. }
55. }

11. 多IDs查询

http://127.0.0.1:9200/student/_search

请求体：

1. {
2. "query": {
3. "ids" : {
4. "values" : ["1001", "1004", "1006"]
5. }
6. }
7. }

结果：

1. {
2. "took": 4,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 3,
13. "relation": "eq"
14. },
15. "max_score": 1.0,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1001",
21. "_score": 1.0,
22. "_source": {
23. "name": "zhangsan",
24. "nickname": "zhangsan",
25. "sex": "男",
26. "age": 30
27. }
28. },
29. {
30. "_index": "student",
31. "_type": "_doc",
32. "_id": "1004",
33. "_score": 1.0,
34. "_source": {
35. "name": "zhangsan1",
36. "nickname": "zhangsan1",
37. "sex": "女",
38. "age": 50
39. }
40. },
41. {
42. "_index": "student",
43. "_type": "_doc",
44. "_id": "1006",
45. "_score": 1.0,
46. "_source": {
47. "name": "zhangsan222",
48. "nickname": "zhangsan222",
49. "sex": "女",
50. "age": 30
51. }
52. }
53. ]
54. }
55. }

12. 前缀查询

http://127.0.0.1:9200/student/_search

请求体内容：

1. {
2. "query": {
3. "prefix": {
4. "name": {
5. "value": "zhangsan"
6. }
7. }
8. }
9. }

13. 单字段排序

sort 可以让我们按照不同的字段进行排序，并且通过 order 指定排序的方式。desc 降序，asc 升序。

在 Postman 中，向 ES 服务器发 GET 请求：http://127.0.0.1:9200/student/_search

1. {
2. "query": {
3. "match": {
4. "name":"zhangsan"
5. }
6. },
7. "sort": [{
8. "age": {
9. "order":"desc"
10. }
11. }]
12. }

14. 多字段排序

假定我们想要结合使用 age 和 _score 进行查询，并且匹配的结果首先按照年龄排序，然后按照相关性得分排序

在 Postman 中，向 ES 服务器发 GET 请求：http://127.0.0.1:9200/student/_search

1. {
2. "query": {
3. "match_all": {}
4. },
5. "sort": [
6. {
7. "age": {
8. "order": "desc"
9. }
10. },
11. {
12. "_score":{
13. "order": "desc"
14. }
15. }
16. ]
17. }

结果：

1. {
2. "took": 17,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 6,
13. "relation": "eq"
14. },
15. "max_score": null,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1004",
21. "_score": 1.0,
22. "_source": {
23. "name": "zhangsan1",
24. "nickname": "zhangsan1",
25. "sex": "女",
26. "age": 50
27. },
28. "sort": [
29. 50,
30. 1.0
31. ]
32. },
33. {
34. "_index": "student",
35. "_type": "_doc",
36. "_id": "1003",
37. "_score": 1.0,
38. "_source": {
39. "name": "wangwu",
40. "nickname": "wangwu",
41. "sex": "女",
42. "age": 40
43. },
44. "sort": [
45. 40,
46. 1.0
47. ]
48. },
49. {
50. "_index": "student",
51. "_type": "_doc",
52. "_id": "1001",
53. "_score": 1.0,
54. "_source": {
55. "name": "zhangsan",
56. "nickname": "zhangsan",
57. "sex": "男",
58. "age": 30
59. },
60. "sort": [
61. 30,
62. 1.0
63. ]
64. },
65. {
66. "_index": "student",
67. "_type": "_doc",
68. "_id": "1005",
69. "_score": 1.0,
70. "_source": {
71. "name": "zhangsan2",
72. "nickname": "zhangsan2",
73. "sex": "女",
74. "age": 30
75. },
76. "sort": [
77. 30,
78. 1.0
79. ]
80. },
81. {
82. "_index": "student",
83. "_type": "_doc",
84. "_id": "1006",
85. "_score": 1.0,
86. "_source": {
87. "name": "zhangsan222",
88. "nickname": "zhangsan222",
89. "sex": "女",
90. "age": 30
91. },
92. "sort": [
93. 30,
94. 1.0
95. ]
96. },
97. {
98. "_index": "student",
99. "_type": "_doc",
100. "_id": "1002",
101. "_score": 1.0,
102. "_source": {
103. "name": "lisi",
104. "nickname": "lisi",
105. "sex": "男",
106. "age": 20
107. },
108. "sort": [
109. 20,
110. 1.0
111. ]
112. }
113. ]
114. }
115. }

15 . 高亮查询

在进行关键字搜索时，搜索出的内容中的关键字会显示不同的颜色，称之为高亮。

在使用 match 查询的同时，加上一个 highlight 属性：

• pre_tags：前置标签
• post_tags：后置标签
• fields：需要高亮的字段
• title：这里声明 title 字段需要高亮，后面可以为这个字段设置特有配置，也可以为空

在 Postman 中，向 ES 服务器发 GET 请求：http://127.0.0.1:9200/student/_search

请求体内容：

1. {
2. "query": {
3. "match": {
4. "name": "zhangsan"
5. }
6. },
7. "highlight": {
8. "pre_tags": "<font color='red'>",
9. "post_tags": "</font>",
10. "fields": {
11. "name": {}
12. }
13. }
14. }

分词查询 name 为 zhangsan，并给 zhangsan 高亮红色

结果：

1. {
2. "took": 27,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 1,
13. "relation": "eq"
14. },
15. "max_score": 1.540445,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1001",
21. "_score": 1.540445,
22. "_source": {
23. "name": "zhangsan",
24. "nickname": "zhangsan",
25. "sex": "男",
26. "age": 30
27. },
28. "highlight": {
29. "name": [
30. "<font color='red'>zhangsan</font>"
31. ]
32. }
33. }
34. ]
35. }
36. }

16. 分页查询

rom：当前页的起始索引，默认从 0 开始。 from = (pageNum - 1) * size

size：每页显示多少条

在 Postman 中，向 ES 服务器发 GET 请求：http://127.0.0.1:9200/student/_search

请求体内容：

1. {
2. "query": {
3. "match_all": {}
4. },
5. "sort": [
6. {
7. "age": {
8. "order": "desc"
9. }
10. }
11. ],
12. "from": 0,
13. "size": 2
14. }

结果：

1. {
2. "took": 5,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 6,
13. "relation": "eq"
14. },
15. "max_score": null,
16. "hits": [
17. {
18. "_index": "student",
19. "_type": "_doc",
20. "_id": "1004",
21. "_score": null,
22. "_source": {
23. "name": "zhangsan1",
24. "nickname": "zhangsan1",
25. "sex": "女",
26. "age": 50
27. },
28. "sort": [
29. 50
30. ]
31. },
32. {
33. "_index": "student",
34. "_type": "_doc",
35. "_id": "1003",
36. "_score": null,
37. "_source": {
38. "name": "wangwu",
39. "nickname": "wangwu",
40. "sex": "女",
41. "age": 40
42. },
43. "sort": [
44. 40
45. ]
46. }
47. ]
48. }
49. }

17. 聚合查询

聚合允许使用者对 es 文档进行统计分析，类似与关系型数据库中的 group by，当然还有很多其他的聚合，例如取最大值、平均值等等。

聚合查询 aggs字段，该字段里的第一个字段是自定义名字，一个聚合/分组需要另一个聚合/分组需要用到自定义名字（嵌套查询）。第二个字段是聚合查询类型。查询结果不仅有聚合结果，也有设计到的详细数据。

结果长度 size字段和 aggs字段同级，代表只获取聚合结果，不获取涉及到的详细数据。

http://127.0.0.1:9200/student/_search

请求体内容:

1. {
2. "aggs" : {//聚合操作
3. "price_group":{ //名称，随意起名
4. "terms":{ //分组操作
5. "field":"age" //分组字段
6. }
7. }
9. },
10. "size":0
11. }

注：如果想求price的平均值,将terms改为avg

服务器响应结果:

结果：

1. {
2. "took": 24,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 6,
13. "relation": "eq"
14. },
15. "max_score": null,
16. "hits": []
17. },
18. "aggregations": {
19. "price_group": {
20. "doc_count_error_upper_bound": 0,
21. "sum_other_doc_count": 0,
22. "buckets": [
23. {
24. "key": 30,
25. "doc_count": 3
26. },
27. {
28. "key": 20,
29. "doc_count": 1
30. },
31. {
32. "key": 40,
33. "doc_count": 1
34. },
35. {
36. "key": 50,
37. "doc_count": 1
38. }
39. ]
40. }
41. }
42. }

简单聚合

• 对某个字段取最大值 max

在 Postman 中，向 ES 服务器发 GET 请求：http://127.0.0.1:9200/student/_search

请求体内容：

1. {
2. "aggs":{
3. "max_age":{ // 自定义名字
4. "max":{"field":"age"}
5. }
6. },
7. "size":0 // 只获取聚合结果，不获取每一个数据
8. }

结果：

1. {
2. "took": 3,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 6,
13. "relation": "eq"
14. },
15. "max_score": null,
16. "hits": []
17. },
18. "aggregations": {
19. "max_age": {
20. "value": 50.0
21. }
22. }

23. }

    • 对某个字段取最小值 min

在 Postman 中，向 ES 服务器发 GET 请求：http://127.0.0.1:9200/student/_search

1. {
2. "aggs":{
3. "min_age":{ // 自定义名字
4. "min":{"field":"age"}
5. }
6. },
7. "size":0 // 只获取聚合结果，不获取每一个数据

8. }

   • 对某个字段求和 sum

在 Postman 中，向 ES 服务器发 GET 请求：http://127.0.0.1:9200/student/_search

请求体内容：

1. {
2. "aggs":{
3. "sum_age":{ // 自定义名字
4. "sum":{"field":"age"}
5. }
6. },
7. "size":0 // 只获取聚合结果，不获取每一个数据

8. }

   • 对某个字段取平均值 avg

在 Postman 中，向 ES 服务器发 GET 请求：http://127.0.0.1:9200/student/_search

1. {
2. "aggs":{
3. "avg_age":{ // 自定义名字
4. "avg":{"field":"age"}
5. }
6. },
7. "size":0 // 只获取聚合结果，不获取每一个数据

8. }

   • 对某个字段的值进行去重之后再取总数

在 Postman 中，向 ES 服务器发 GET 请求：http://127.0.0.1:9200/student/_search

1. {
2. "aggs":{
3. "distinct_age":{ // 自定义名字
4. "cardinality":{"field":"age"}
5. }
6. },
7. "size":0 // 只获取聚合结果，不获取每一个数据

8. }

   • State 聚合

stats 聚合，对某个字段一次性返回 count，max，min，avg 和 sum 五个指标

在 Postman 中，向 ES 服务器发 GET 请求 ：http://127.0.0.1:9200/student/_search

1. {
2. "aggs":{
3. "stats_age":{ // 自定义名字a
4. "stats":{"field":"age"}
5. }
6. },
7. "size":0 // 只获取聚合结果，不获取每一个数据
8. }

结果：

1. {
2. "took": 5,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 6,
13. "relation": "eq"
14. },
15. "max_score": null,
16. "hits": []
17. },
18. "aggregations": {
19. "stats_age": {
20. "count": 6,
21. "min": 20.0,
22. "max": 50.0,
23. "avg": 33.333333333333336,
24. "sum": 200.0
25. }
26. }
27. }

桶聚合查询

桶聚和相当于 sql 中的 group by 语句

• terms 聚合，分组统计

在 Postman 中，向 ES 服务器发 GET 请求：http://127.0.0.1:9200/student/_search

1. {
2. "aggs":{
3. "age_groupby":{ // 自定义名字
4. "terms":{"field":"age"}
5. }
6. },
7. "size":0 // 只获取聚合结果，不获取每一个数据
8. }

结果：

1. {
2. "took": 1,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 6,
13. "relation": "eq"
14. },
15. "max_score": null,
16. "hits": []
17. },
18. "aggregations": {
19. "age_groupby": {
20. "doc_count_error_upper_bound": 0,
21. "sum_other_doc_count": 0,
22. "buckets": [
23. {
24. "key": 30,
25. "doc_count": 3
26. },
27. {
28. "key": 20,
29. "doc_count": 1
30. },
31. {
32. "key": 40,
33. "doc_count": 1
34. },
35. {
36. "key": 50,
37. "doc_count": 1
38. }
39. ]
40. }
41. }

42. }

    • 嵌套查询

在 Postman 中，向 ES 服务器发 GET 请求 ：http://127.0.0.1:9200/student/_search

1. {
2. "aggs":{
3. "age_groupby":{ // 自定义名字
4. "terms":{
5. "field": "age",
6. },
7. "aggs": {
8. "average_age": {
9. "avg": {
10. "field": "age"
11. }
12. }
13. }
14. }
15. },
16. "size":0 // 只获取聚合结果，不获取每一个数据
17. }

结果：

1. {
2. "took": 5,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 6,
13. "relation": "eq"
14. },
15. "max_score": null,
16. "hits": []
17. },
18. "aggregations": {
19. "age_groupby": {
20. "doc_count_error_upper_bound": 0,
21. "sum_other_doc_count": 0,
22. "buckets": [
23. {
24. "key": 30,
25. "doc_count": 3,
26. "average_age": {
27. "value": 30.0
28. }
29. },
30. {
31. "key": 20,
32. "doc_count": 1,
33. "average_age": {
34. "value": 20.0
35. }
36. },
37. {
38. "key": 40,
39. "doc_count": 1,
40. "average_age": {
41. "value": 40.0
42. }
43. },
44. {
45. "key": 50,
46. "doc_count": 1,
47. "average_age": {
48. "value": 50.0
49. }
50. }
51. ]
52. }
53. }

54. }

    先对 age 进行分组，分组后进行 求平均值。 例如： age为30的平均值为 30。

    • 在 terms 分组下再进行聚合和排序

这里就用到了自定义的名字，average_age名代表对 age 取平均值，age_groupby里先对 age 进行分组，再取平均值并且排序，所以需要 average_age 名。

1. {
2. "aggs":{
3. "age_groupby":{ // 自定义名字
4. "terms":{
5. "field": "age",
6. "order": {
7. "average_age": "desc"
8. }
9. },
10. "aggs": {
11. "average_age": {
12. "avg": {
13. "field": "age"
14. }
15. }
16. }
17. }
18. },
19. "size":0 // 只获取聚合结果，不获取每一个数据
20. }

结果：

1. {
2. "took": 4,
3. "timed_out": false,
4. "_shards": {
5. "total": 1,
6. "successful": 1,
7. "skipped": 0,
8. "failed": 0
9. },
10. "hits": {
11. "total": {
12. "value": 6,
13. "relation": "eq"
14. },
15. "max_score": null,
16. "hits": []
17. },
18. "aggregations": {
19. "age_groupby": {
20. "doc_count_error_upper_bound": 0,
21. "sum_other_doc_count": 0,
22. "buckets": [
23. {
24. "key": 50,
25. "doc_count": 1,
26. "average_age": {
27. "value": 50.0
28. }
29. },
30. {
31. "key": 40,
32. "doc_count": 1,
33. "average_age": {
34. "value": 40.0
35. }
36. },
37. {
38. "key": 30,
39. "doc_count": 3,
40. "average_age": {
41. "value": 30.0
42. }
43. },
44. {
45. "key": 20,
46. "doc_count": 1,
47. "average_age": {
48. "value": 20.0
49. }
50. }
51. ]
52. }
53. }
54. }

先对 age 进行分组，分组后进行降序排列。然后求平均值。

Elasticsearch入门（三）高级查询操作_明湖起风了的博客-CSDN博客