note:
- es at least version 6.1 and above
Statement:
GET 76/sessions/_search
{
"size": 0,
"query": {
"bool": {
"must": [
{
"term": { "sid": { "value": "76e14832" } } }, { "range": { "v_ymd": { "format": "yyyy-MM-dd", "gte": "2018-02-02", "lte": "2018-02-02" } } } ] } }, "aggs": { "pv": { "nested": { "path": "scene" }, "aggs": { "pv2": { "terms": { "field": "scene.pid", "size": 1000, "shard_size": 10000 }, "aggs": { "pv_count": { "value_count": { "field": "scene.pid" } }, "r_bucket_sort": { "bucket_sort": { "sort": { "pv_count": { "order": "desc" } }, "from": 10, "size": 10 } } } } } } } }
Part of the explanation:
- Outermost size = 0, indicating that the query does not return before returning just polymerization results;
- query using a list of data must be filtered;
- terms functions to achieve sub-barrel, similar to the function in sql packet;
- shard_size terms of the amount of data returned by each slice, bucket size represents data returned, will receive bucket_sort limited in size;
- value_count implement a counting function;
- sort fields specified sort ascending and descending sort, the field may be used after polymerization;
- Use bucket_sort features, from, size respectively from the first few data start, how many data fetch.
pay attention:
- Use bucket_sort functional in terms of time, in terms of packet size should be larger than the size of the set size + size of the bucket_sort from, or because the size of the size limit in terms of the data returned.
- bucket_sort sort of sorting are sorted for the parent polymerization results returned, for example as a result of the terms returned 1000, 1000 so that only bucket_sort sort.