弹性平均Bool 查询中的聚合

Question

在 Elastic 中，我正在尝试对 bool 查询过滤器进行平均聚合。但我得到 unable to parse BaseAggregationBuilder with name [query]: parser not found。

我的目标：

1. 过滤 processName：AddCustomer 和 messageType：Response 文件。
2. 使用字段 elapsed_time 查找过滤数据的平均响应时间

我的代码

{
  "from": 0,
  "size": 20,
  "aggs": {
    "filtered_elapsed_time": {
        "query": {
            "bool": {
              "should": [
                {
                  "bool": {
                    "must": [
                      {
                        "match": {
                          "processName": "AddCustomer"
                        }
                      },
                      {
                        "match": {
                          "messageType": "Response"
                        }
                      }
                    ]
                  }
                }
              ]
            }       
      },
      "aggs": {
        "avg_et": {
          "avg": {
            "field": "elapsed_time"
          }
        }
      }
    }
  }
}  

错误响应

{
  "error": {
    "root_cause": [
      {
        "type": "named_object_not_found_exception",
        "reason": "[6:18] unable to parse BaseAggregationBuilder with name [query]: parser not found"
      }
    ],
    "type": "named_object_not_found_exception",
    "reason": "[6:18] unable to parse BaseAggregationBuilder with name [query]: parser not found"
  },
  "status": 400
}

Answer 1

添加一个包含索引数据、搜索查询和搜索结果的工作示例

索引数据：

{
  "processName":"AddCustomer",
  "messageType":"Response",
   "elapsed_time":20
}
{
  "processName":"AddCustomer",
  "messageType":"Response",
   "elapsed_time":10
}

搜索查询：

{                   <-- note this
  "query": {
    "bool": {
      "should": [
        {
          "bool": {
            "must": [
              {
                "match": {
                  "processName": "AddCustomer"
                }
              },
              {
                "match": {
                  "messageType": "Response"
                }
              }
            ]
          }
        }
      ]
    }
  },
  "aggs": {
    "avg_et": {
      "avg": {
        "field": "elapsed_time"
      }
    }
  }
}

搜索结果：

"hits": [
      {
        "_index": "64444060",
        "_type": "_doc",
        "_id": "1",
        "_score": 0.36464313,
        "_source": {
          "processName": "AddCustomer",
          "messageType": "Response",
          "elapsed_time": 10
        }
      },
      {
        "_index": "64444060",
        "_type": "_doc",
        "_id": "2",
        "_score": 0.36464313,
        "_source": {
          "processName": "AddCustomer",
          "messageType": "Response",
          "elapsed_time": 20
        }
      }
    ]
  },
  "aggregations": {
    "avg_et": {
      "value": 15.0        <-- note this
    }
  }

更新 1：

您的搜索查询也可以使用，只需将 query 替换为 filter 关键字

如果您使用Filter aggregation 将当前聚合上下文缩小到特定的文档集，那么修改后的搜索查询将是：

{
  "from": 0,
  "size": 20,
  "aggs": {
    "filtered_elapsed_time": {
      "filter": {               <-- note this
        "bool": {
          "should": [
            {
              "bool": {
                "must": [
                  {
                    "match": {
                      "processName": "AddCustomer"
                    }
                  },
                  {
                    "match": {
                      "messageType": "Response"
                    }
                  }
                ]
              }
            }
          ]
        }
      },
      "aggs": {
        "avg_et": {
          "avg": {
            "field": "elapsed_time"
          }
        }
      }
    }
  }
}