相关阅读：https://www.elastic.co/guide/en/elasticsearch/reference/7.4/search-aggregations-pipeline.html
Pipeline Aggregation ⽀持对聚合分析的结果，再次进⾏聚合分析。Pipeline 的分析结果会输出到原结果中，根据位置的不同，分为两类：
- Sibling - 结果和现有分析结果同级
- max_bucket，min_bucket，avg_bucket 和 sum_bucket
- stats_bucket，extended_stats_bucket
- percentiles_bucket
- Parent - 结果内嵌到现有的聚合分析结果之中
- derivative （求导）
- cumulative_sum （累计求和）
- moving function (滑动窗⼝)
1. Sibling Pipeline
比如需要在员⼯数最多的⼯种⾥，找出平均⼯资最低的⼯种，查询响应示例如下：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
| POST employees/_search
{
"size": 0,
"aggs": {
"jobs": {
"terms": {
"field": "job.keyword",
"size": 10
},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
}
}
},
"min_salary_by_job":{
"min_bucket": {
"buckets_path": "jobs>avg_salary"
}
}
}
}
|
2. Parent Pipeline
比如按照年龄，对⼯资进⾏求导（看⼯资发展的趋势）
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
| POST employees/_search
{
"size": 0,
"aggs": {
"age": {
"histogram": {
"field": "age",
"min_doc_count": 1,
"interval": 1
},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
},
"derivative_avg_salary":{
"derivative": {
"buckets_path": "avg_salary"
}
}
}
}
}
}
|
或者求平均工资的滑动窗口值：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
| POST employees/_search
{
"size": 0,
"aggs": {
"age": {
"histogram": {
"field": "age",
"min_doc_count": 1,
"interval": 1
},
"aggs": {
"avg_salary": {
"avg": {
"field": "salary"
}
},
"moving_avg_salary":{
"moving_fn": {
"buckets_path": "avg_salary",
"window":10,
"script": "MovingFunctions.min(values)"
}
}
}
}
}
}
|
响应如下：
