Important concepts in [Elasticsearch] aggregation-Buckets (barrels) and metrics (indicators)

Important concepts in [Elasticsearch] aggregation-Buckets (barrels) and metrics (indicators) 2015-01-04 Source: http://blog.csdn.net/dm_vincent/article/details/42387161

This chapter is translated from the Aggregations-high-level Concepts chapter of the Official Elasticsearch guide.

High-level concept (high-level concepts)

Like querying a DSL, aggregations (aggregations) have a composable (composable) syntax: Separate functional units can be mixed together to meet your needs. This means that the basic concepts that need to be learned are not many, but they are combined in almost infinite ways.

To master aggregations, you only need to know two main concepts:

Buckets (barrels):

A collection of documents that satisfies a condition.

Metrics (indicator):

Calculates the statistics for a document in a bucket.

That's it! Each aggregation is simply a combination of one or more buckets, 0 or more indicators. You can convert it roughly to SQL:

SELECT COUNT (color) from TableGroup by color

The count (color) above is equivalent to an indicator. GROUP by color is equivalent to a bucket.

Buckets and groups in SQL (Grouping) have similar concepts, while indicators are similar to count (), SUM (), MAX (), and so on.

Let's take a closer look at these concepts.

Barrels (Buckets)

A bucket is a collection of documents that satisfies a particular condition:

• An employee is either a male barrel or a female barrel.
• The city Albany belongs to the New York State of this bucket.
• Date 2014-10-28 belongs to October this barrel.

As aggregations are executed, the values in each document are computed to determine whether they match the conditions of the bucket. If the match succeeds, the document is placed in the bucket, and the aggregation continues to execute.

Buckets can also be nested in other buckets, allowing you to complete levels or conditions to divide these requirements. For example, Cincinnati can be placed in the barrel of the Ohio State, while the entire Ohio State can be placed in the barrel of the United States.

There are many types of buckets in Es that allow you to divide documents into multiple ways (by the hour, by the most popular terms, by age range, by geography, and more). But fundamentally, they all operate according to the same principle: the document is divided according to the conditions.

Indicator (Metrics)

Buckets allow us to make a meaningful division of the document, but in the end we still need to do some sort of metric calculation for the document in each bucket. Buckets are a means of achieving the ultimate goal: it provides a way to divide the document so that you can calculate the required metrics.

Most indicators are simply mathematical operations (such as Min,mean,max and Sum), which are calculated using the values in the document. In practice, the indicator allows you to calculate the average salary, the highest selling price, or the 95 query delay.

Combine the two.

An aggregation is a combination of some buckets and indicators. An aggregation can have only one bucket, or one indicator, or one per sample. You can even have more than one nested bucket in a bucket. For example, we can divide the document into the country in which it belongs, and then calculate its average salary (one indicator) for each bucket.

Because buckets can be nested, we are able to implement a more complex aggregation operation:

1. Divide the document into barrels according to the country. Cans
2. Then the barrels of each country are then divided by sex. Cans
3. The barrels of each sex are then divided into barrels according to the age range. Cans
4. Finally, the average salary is calculated for each age range. Indicators

At this point, you can get the average salary information for each < country, gender, age > combination. It can be done with a request, a data traversal!

Important concepts in [Elasticsearch] aggregation-Buckets (barrels) and metrics (indicators)