多个字段groupby 查询terms的字段和求和,目前采用的是管道聚合符合要求,但数据量大(几千万条数据)之后反而很慢,求解决思路
GET xxx-20240929/_search
{
"size": 0,
"timeout": "5m",
"query": {
"bool": {
"should": [
{
"bool": {
"must_not": [
{
"term": {
"a.country": {
"value": "中国"
}
}
}
]
}
},
{
"bool": {
"must_not": [
{
"term": {
"b.country": {
"value": "中国"
}
}
}
]
}
}
],
"must": [
{
"range": {
"ts": {
"gte": 1726290562000,
"lte": 1726549762000
}
}
}
]
}
},
"sort": [
{
"ts": {
"order": "desc"
}
}
],
"track_total_hits": true,
"aggregations": {
"totalCount": {
"cardinality": {
"script": {
"source": "doc['hg'].value+'__##__'+doc['kp'].value",
"lang": "painless"
}
}
},
"NAME": {
"terms": {
"script": {
"source": "doc['hg'].value+'__##__'+doc['kp'].value",
"lang": "painless"
},
"size": 50,
"min_doc_count": 1,
"shard_min_doc_count": 0,
"show_term_doc_count_error": false,
"order": [
{
"glowEnd": "desc"
},
{
"_key": "asc"
}
]
},
"aggregations": {
"bytesToClient": {
"sum": {
"field": "glow.bytes_toclient"
}
},
"bytesToServer": {
"sum": {
"field": "glow.bytes_toserver"
}
},
"glowAge": {
"sum": {
"field": "glow.age"
}
},
"hgpt": {
"terms": {
"field": "hgpt",
"size": 100,
"min_doc_count": 1,
"shard_min_doc_count": 0,
"show_term_doc_count_error": false,
"order": [
{
"_count": "desc"
},
{
"_key": "asc"
}
]
}
},
"kppt": {
"terms": {
"field": "kppt",
"size": 100,
"min_doc_count": 1,
"shard_min_doc_count": 0,
"show_term_doc_count_error": false,
"order": [
{
"_count": "desc"
},
{
"_key": "asc"
}
]
}
},
"glowEnd": {
"max": {
"field": "glow.end"
}
},
"glowStart": {
"min": {
"field": "glow.start"
}
},
"topHits": {
"top_hits": {
"from": 0,
"size": 1,
"version": false,
"seq_no_primary_term": false,
"explain": false,
"sort": [
{
"ts": {
"order": "desc"
}
}
]
}
},
"pages": {
"bucket_sort": {
"sort": [],
"from": 1,
"size": 50,
"gap_policy": "SKIP"
}
}
}
}
}
}