弹性搜索组由许多字段聚合组成

Question

我不想使用elasticsearch通过聚合来实现以下组。 SQL等价物就像（有点）：

SELECT MIN(unix_time) as min_utime, MAX(unix_time) as max_utime
FROM myindex
GROUP BY http_user, src

聚合会是这样的吗？

"aggs":{
    "suser":{
        "terms":{
            "field":"http_user"
        },
        "aggs":{
            "src":{
                "terms":{
                    "field":"src"
                },
                "aggs":{
                    "max_utime":{
                        "max":{
                            "field":"unix_time"
                        }
                    },
                    "min_utime":{
                        "min":{
                            "field":"unix_time"
                        }
                    }
                }
            }
        }
    }            
}

我不确定我是否正确理解了聚合内容。我是对的吗？

创建测试以模拟解决方案。我以列表[dict（str，T）]的形式为每个桶名称和密钥或度量和值提取聚合

for suser in aggregations.get("suser").get("buckets"):
    for src in suser.get('src').get('buckets'):
        row = dict(suser=suser.get('key'), src=src.get('key'),
                   min_utime=src.get('min_utime').get("value"),
                   max_utime=src.get("max_utime").get("value"))

        results_array.append(row)

first_row = results_array[0]
http_user = first_row.get('suser')
src = first_row.get('src')

new_query = {
    'query': {
        'bool': {
            'must': [
                {"term":{'http_user': http_user}},
                {"term":{'src': src}}
            ],
            "filter":{
                "range":{
                    "@timestamp":{
                         'gte': datetime.datetime(2016, 10, 3, 10, 22, 44, 569755), 
                         'lte': datetime.datetime(2016, 10, 3, 14, 22, 44, 569755)
                }
            }
        }
    }
}

sort = ["unix_time:asc"]

results = []
for hit in scan(es_client, index="my_index", query=new_query, sort=sort)
        results.append(hit)

first_hit = results[0].get('_source')

self.assertEqual(first_row.get("min_utime"),
                 first_hit.get("unix_time"))

测试随机成功并失败。结果时间也不相等（尽管我提供的日期时间总是与查询聚合和新查询中看到的相同。）

测试结果：

AssertionError: 1475489579.0 != 1475489620
AssertionError: 1475489961.0 != 1475489980