elasticsearch

Question

最近我正致力于弹性搜索聚合。我想通过两个字段（AccountId和RestapiId）对数据进行分类，以计算ThrottleByApiId的比率。

我的数据如下：

{
        "AccountId": "12345678909",
        "Marketplace": "us",
        "Operation": "InvokeGet",
        "RestapiId": "ajsdf87238",
        "InvokingPath": "/path/path/path",
        "ThrottleByAccount": 1,
        "ThrottleByApiId": 1
}

我想要的结果如下:(英文）

for account=12345678909 and RestapiId= ajsdf87238, the rate of ThrottleByAccount is 1.0(for example).

我知道_copy_to和脚本都可以做到这一点，但我不确定哪一个更好。 另一个问题是，我试图使用脚本。 我的查询是这样的：

{
      'size': 0,
      'query': {
          'filtered': {
              'query': {
                  'match_all': {}
              },
              'filter': {
                  'range': {
                      'StartTime': {'gte': 1467579710,
                                    'lte': 1467579730
                      }
                  }
              }
          }
      },
      'aggs': {
          'rateByAccount': {
              'terms': {
                  "script": "[doc.AccountId.value, doc.apiId.value].join(\"-\")"
              },
              'aggs': {
                  'ThrottleByApiId_Rate': {'avg': {'field': 'ThrottleByApiId'}}
              }
          }
      }
  }

对于“脚本”中的语法，除上述语法外，我还尝试过：

"script": "doc['AccountId'].value" + " | " + "doc['RestapiId'].value"

和

"script": "doc['AccountId']" + " | " + "doc['RestapiId']"

和

"script": "doc['AccountId'] + doc['RestapiId']"

但任何人都无法工作。 我收到这个错误：

File "search_eg.py", line 102, in search_fieldsss
    'ThrottleByApiId_Rate': {'avg': {'field': 'ThrottleByApiId'}}
  File "/usr/local/lib/python2.7/site-packages/elasticsearch/client/utils.py", line 69, in _wrapped
    return func(*args, params=params, **kwargs)
  File "/usr/local/lib/python2.7/site-packages/elasticsearch/client/__init__.py", line 548, in search
    doc_type, '_search'), params=params, body=body)
  File "/usr/local/lib/python2.7/site-packages/elasticsearch/transport.py", line 329, in perform_request
    status, headers, data = connection.perform_request(method, url, params, body, ignore=ignore, timeout=timeout)
  File "/usr/local/lib/python2.7/site-packages/elasticsearch/connection/http_urllib3.py", line 109, in perform_request
    self._raise_error(response.status, raw_data)
  File "/usr/local/lib/python2.7/site-packages/elasticsearch/connection/base.py", line 108, in _raise_error
    raise HTTP_EXCEPTIONS.get(status_code, TransportError)(status_code, error_message, additional_info)
elasticsearch.exceptions.RequestError: <exception str() failed>

在错误消息中，有人说错了 'ThrottleByApiId_Rate'：{'avg'：{'field'：'ThrottleByApiId'}}。 但我尝试用直接字段聚合替换脚本聚合，如下所示：

'aggs': {
          'rateByAccount': {
              'terms': {'field': 'AccountId'},
              'aggs': {
                  'ThrottleByApiId_Rate': {'avg': {'field': 'ThrottleByApiId'}}
              }
          }
      }

它工作正常。所以我不认为错误信息是准确的。脚本语法有问题，而不是平均计算语法。

任何人都可以帮我解决这个问题吗？