elasticsearch7.6文档解析-avg聚合

文档格式如下:

{
                    
                    "account_number": 1,
                    "balance": 39225,
                    "firstname": "Amber",
                    "lastname": "Duke",
                    "age": 32,
                    "gender": "M",
                    "address": "880 Holmes Lane",
                    "employer": "Pyrami",
                    "email": "[email protected]",
                    "city": "Brogan",
                    "state": "IL"
}

现在我们求age的平均值:

方法1:

POST /exams/_search?size=0
{
    "aggs" : {
        "avg_grade" : { "avg" : { "field" : "age" } }
    }
}

方法2:

POST /exams/_search?size=0
{
    "aggs" : {
        "avg_grade" : {
            "avg" : {
                "script" : {
                    "source" : "doc.grade.value"
                }
            }
        }
    }
}

方法3：脚本写在内部:

先看官方示例:

POST /exams/_search?size=0
{
    "aggs" : {
        "avg_corrected_grade" : {
            "avg" : {
                "field" : "grade",
                "script" : {
                    "lang": "painless",
                    "source": "_value * params.correction",
                    "params" : {
                        "correction" : 1.2
                    }
                }
            }
        }
    }
}
这个示例可以了解它是怎么向内部脚本传参的。些处外部参数(内部脚本或者储存的脚本里都一样)在脚本里用params.key的形式来访问。

{
	"size":1,
	"aggs":{
		"average_balance":{
			"avg":{
				"field":"age",
				"script":{
					"lang":"painless",
					"source":"_value*2"//这里可以对结果进行一定运算
				}
			}
		}
	}
}

方法4，就是用储存的脚本.

step1:

我们先创建一个脚本:

post 127.0.0.1:9200/_scripts/my_script2

{
	"script":{
		"lang":"painless",
		"source":"doc['age'].value*2"
	}
}

多字段的情况下:
{
	"script":{
		"lang":"painless",
		"source":"doc['balance'].value+doc['age'].value*2"
	}
}

step2 然后指定脚本:

{
	"size":1,
	"aggs":{
		"average_balance":{
			"avg":{
				"script":{
                    "id": "my_script2",
                    "params":{
                    	"field":"age,balance"
                    }
				}
			}
		}
	}
}

还有一种情况，假设当中有一个文档没有age这个字段，我们这样处理:

POST /exams/_search?size=0
{
    "aggs" : {
        "grade_avg" : {
            "avg" : {
                "field" : "grade",
                "missing": 10 
            }
        }
    }
}

就是当它没有这个字段时就给它个默认值10来参与平均运算