es查询，聚合、平均值、值范围、cardinality去重查询

原文：https://blog.csdn.net/sxf_123456/article/details/78195829

普通查询

GET ana-apk/_search
{
  "query": {
    "match_all": {}
  }
}

查询不重复的mac地址

GET ana-apk/_search
{
  "size": 10,
  "aggs": {
    "MAC": {
      "cardinality": {
        "field": "MAC.keyword"
      }
    }
  },
  "_source":{
    "include":["MAC","ProbeOUI","RTPLossRate"]
  }
}

计算RTPLossRate的平均值

GET ana-apk/_search
{
  "size": 0,
  "aggs": {
    "avg_RTPLossRate": {
      "avg": {
        "field": "RTPLossRate"
      }
    }
  }
}

查询RTPLossRate小于0的值

GET ana-apk/_search
{
  "size": 10,
  "query": {
    "range": {
      "RTPLossRate": {
        "lt": 0
      }
    }
  },
  "_source":{
    "include":["MAC","ProbeOUI","RTPLossRate","message"]
  }
}

查询RTPLossRate大于等于0小于等于1000的值

GET ana-apk/_search
{
  "size": 10,
  "query": {
    "range": {
      "RTPLossRate": {
        "gte": 0,
        "lte": 1000
      }
    }
  },
  "aggs": {
    "avg_RTPLossRate": {
      "avg": {
        "field": "RTPLossRate"
      }
    }
  }
}

查询RTPLossRate在0到1000之间的数据，并输出字段为OUI的10个值

GET ana-apk/_search
{
  "size": 0,
  "query": {
    "range": {
      "RTPLossRate": {
        "gte": 0,
        "lte": 1000
      }
    }
  },
  "aggs": {
    "NAME": {
      "terms": {
        "field": "OUI",
        "size": 10
      }
    }
  }
}

查询字段OUI包含SKYWORTH的值，并且RTPLossRate的范围在0到1000之间，计算RTPLossRate的平均值

GET ana-apk/_search
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {"term": {
          "OUI": {
            "value": "SKYWORTH"
          }
        }},
        {"range": {
          "RTPLossRate": {
            "gte": 0,
            "lte": 1000
          }
        }}
      ]
    }},
    "aggs": {
      "avg_RTPLossRate": {
        "avg": {
          "field": "RTPLossRate"
        }
      }
    }
}

支持原创，请移步原文：https://blog.csdn.net/sxf_123456/article/details/78195829​​​​​​​