Question

可以说我有这些数据样本：

{
    "date": "2019-06-16",
    "rank": 150
    "name": "doc 1"
}

{
    "date": "2019-07-16",
    "rank": 100
    "name": "doc 1"
}

{
    "date": "2019-06-16",
    "rank": 50
    "name": "doc 2"
}

{
    "date": "2019-07-16",
    "rank": 80
    "name": "doc 2"
}

预期结果是通过从日期不同（旧日期-新日期）的两个相同名称的文档中减去等级字段：

{
    "name": "doc 1",
    "diff_rank": 50
}

{
    "name": "doc 2",
    "diff_rank": -30
}

并尽可能按diff_rank进行排序，否则我将在得到结果后手动进行排序。

我尝试过使用date_histogram和serial_diff，但是某些结果缺少了diff_rank值，因此我确定数据存在：

{
   "aggs" : {
        "group_by_name": {
            "terms": {
                "field": "name"
            },
            "aggs": {
                "days": {
                    "date_histogram": {
                        "field": "date",
                        "interval": "day"
                     },
                    "aggs": {
                        "the_rank": {
                            "sum": {
                                "field": "rank"
                            }
                        },
                        "diff_rank": {
                           "serial_diff": {
                              "buckets_path": "the_rank",
                              "lag" : 30 // 1 month or 30 days in this case
                           }
                        }
                    }
                }
            }
        }
    }
}

非常感谢您提供的帮助来解决我的上述问题！

Answer 1

最后，我从官方文档中找到了一种使用Filter，Bucket Script聚合和Bucket Sort对结果进行排序的方法。这是最后的代码段：

{
    "size": 0,
    "aggs" : {
        "group_by_name": {
            "terms": {
                "field": "name",
                "size": 50,
                "shard_size": 10000
            },
            "aggs": {
                "last_month_rank": {
                    "filter": {
                        "term": {"date": "2019-06-17"}
                     },
                    "aggs": {
                        "rank": {
                            "sum": {
                                "field": "rank"
                            }
                        }
                    }
                },
                "latest_rank": {
                    "filter": {
                        "term": {"date": "2019-07-17"}
                     },
                    "aggs": {
                        "rank": {
                            "sum": {
                                "field": "rank"
                            }
                        }
                    }
                },
                "diff_rank": {
                    "bucket_script": {
                        "buckets_path": {
                          "lastMonthRank": "last_month_rank>rank",
                          "latestRank": "latest_rank>rank"
                        },
                        "script": "params.lastMonthRank - params.latestRank"
                    }
                },
                "rank_bucket_sort": {
                    "bucket_sort": {
                        "sort": [
                            {"diff_rank": {"order": "desc"}}
                        ],
                        "size": 50
                    }
                }
            }
        }
    }
}

减去具有不同时间戳的两个文档之间的数字字段

1 个答案: