如何在Elasticsearch中实现多字段求和（字段）分组？

Question

我正在使用logstash将行数据从MySQL保存到ElasticSearch。如何计算两个字段对一个字段组的求和？

例如，这里有一个名为“ Students”的表，它具有几列：id，class_id，姓名，性别，年龄； 这是一个SQL查询：

select class_id, gender, sum(age) from Students group by class_id, gender;

如何将此SQL转换为ElasticSearch高级其余客户端API调用？ 以下是我的尝试，但不正确：

public TermsAggregationBuilder constructAggregation() {
    TermsAggregationBuilder aggregation = AggregationBuilders.terms("by_classid")
            .field("classId.keyword");
    aggregation = aggregation.subAggregation(AggregationBuilders.terms("by_gender").field("gender.keyword"));
    aggregation = aggregation.subAggregation(AggregationBuilders.sum("sum_age")
            .field("age"));
    return aggregation;
  }

Answer 1

以下是您的sql语句的原始查询

POST aggregation_index_2/_search
{
  "size": 0,
  "aggs": {
    "gender_agg": {
      "terms": {
        "field": "gender"
      },
      "aggs": {
        "class_id_aggregator": {
          "terms": {
         "aggs": {
              "field": "class_id"
          },
           "age_sum_aggregator": {
              "sum": {
                "field": "age"
              }
            }
          }
        }
      }
    }
  }
}

映射

PUT aggregation_index_2
{
  "mappings": {
    "properties": {
      "gender": {
        "type": "keyword"
      },
      "age": {
        "type": "integer"
      },
      "class_id": {
        "type": "integer"
      }
    }
  }
}