python elasticsearch 分组统计

聚合（Aggregations）：

     query = {
            "query": {
                "bool": {
                    "must": [
                        {"term": {"company_id": company_id}},
                        {"term": {"subject_type": 2}},


                    ],
                    "must_not": [],
                    "should": []
                }
            },
            "size": 0,   # 设置返回信息条数
            "aggs": {
                "group_by_real_name": {
                    "terms": {"field": "real_name.keyword"},   
                    "aggs": {                       #条件嵌套
                        "group_by_screen_id": {
                            "terms": {"field": "screen_id"},
                }
            }
        }
    }
}

设置fielddata=true:

在系统终端设置：

curl -i -H "Content-Type:application/json" -XPUT 127.0.0.1:9200/your_index/_mapping/your_type/?pretty  -d'{"your_type":{"properties":{"your_field_name":{"type":"text","fielddata":true}}}}'

将以上标红位置更改为自己对应的字段，在Linux上似乎可以直接操作，windows似乎需要下一个curl插件，我未曾设置过fielddata=true，我是使用了上面real_name.keyword方法。

curl -i -H "Content-Type:application/json" -XPUT 127.0.0.1:9200/event/_mapping/koala-index/?pretty  -d'{"koala-index":{"properties":{"real_name":{"type":"text","fielddata":true}}}}'
 

去重统计：

query = {
    "query": {
        "bool": {
            "must": [
                {"term": {"company_id": company_id}},
            ],
            "must_not": [],
            "should": []
        }
    },
    "size": 0,
    "aggs": {
        "group_by_screen_id": {
            "terms": {"field": "screen_id"},
            "aggs": {"group_by_subject_type": {
                "terms": {"field": "subject_type"},
                "aggs": {"distinct_subject_ids": {       #去重统计
                    "cardinality": {"field": "subject_id"}
                }
                }
            }
            }
        }
    },
     "sort": [
       {"timestamp": {"order": 'desc'}}
     ],
    "from": (page - 1) * size,
    "size": size,
}