mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-04-25 15:47:23 -04:00
32e23b9100
Most aggregations (terms, histogram, stats, percentiles, geohash-grid) now support a new `missing` option which defines the value to consider when a field does not have a value. This can be handy if you eg. want a terms aggregation to handle the same way documents that have "N/A" or no value for a `tag` field. This works in a very similar way to the `missing` option on the `sort` element. One known issue is that this option sometimes cannot make the right decision in the unmapped case: it needs to replace all values with the `missing` value but might not know what kind of values source should be produced (numerics, strings, geo points?). For this reason, we might want to add an `unmapped_type` option in the future like we did for sorting. Related to #5324
101 lines
3 KiB
Text
101 lines
3 KiB
Text
[[search-aggregations-metrics-sum-aggregation]]
|
|
=== Sum Aggregation
|
|
|
|
A `single-value` metrics aggregation that sums up numeric values that are extracted from the aggregated documents. These values can be extracted either from specific numeric fields in the documents, or be generated by a provided script.
|
|
|
|
Assuming the data consists of documents representing stock ticks, where each tick holds the change in the stock price from the previous tick.
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
{
|
|
"query" : {
|
|
"filtered" : {
|
|
"query" : { "match_all" : {}},
|
|
"filter" : {
|
|
"range" : { "timestamp" : { "from" : "now/1d+9.5h", "to" : "now/1d+16h" }}
|
|
}
|
|
}
|
|
},
|
|
"aggs" : {
|
|
"intraday_return" : { "sum" : { "field" : "change" } }
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
|
|
The above aggregation sums up all changes in the today's trading stock ticks which accounts for the intraday return. The aggregation type is `sum` and the `field` setting defines the numeric field of the documents of which values will be summed up. The above will return the following:
|
|
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
{
|
|
...
|
|
|
|
"aggregations": {
|
|
"intraday_return": {
|
|
"value": 2.18
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
|
|
The name of the aggregation (`intraday_return` above) also serves as the key by which the aggregation result can be retrieved from the returned response.
|
|
|
|
==== Script
|
|
|
|
Computing the intraday return based on a script:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
{
|
|
...,
|
|
|
|
"aggs" : {
|
|
"intraday_return" : { "sum" : { "script" : "doc['change'].value" } }
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
|
|
TIP: The `script` parameter expects an inline script. Use `script_id` for indexed scripts and `script_file` for scripts in the `config/scripts/` directory.
|
|
|
|
===== Value Script
|
|
|
|
Computing the sum of squares over all stock tick changes:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
{
|
|
"aggs" : {
|
|
...
|
|
|
|
"aggs" : {
|
|
"daytime_return" : {
|
|
"sum" : {
|
|
"field" : "change",
|
|
"script" : "_value * _value" }
|
|
}
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
|
|
==== Missing value
|
|
|
|
The `missing` parameter defines how documents that are missing a value should be treated.
|
|
By default they will be ignored but it is also possible to treat them as if they
|
|
had a value.
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
{
|
|
"aggs" : {
|
|
"total_time" : {
|
|
"sum" : {
|
|
"field" : "took",
|
|
"missing": 100 <1>
|
|
}
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
|
|
<1> Documents without a value in the `took` field will fall into the same bucket as documents that have the value `100`.
|