原文：https://blog.csdn.net/sxf_123456/article/details/78195829
普通查询
GET ana-apk/_search { "query": { "match_all": {} } }
查询不重复的mac地址
GET ana-apk/_search { "size": 10, "aggs": { "MAC": { "cardinality": { "field": "MAC.keyword" } } }, "_source":{ "include":["MAC","ProbeOUI","RTPLossRate"] } }
计算RTPLossRate的平均值
GET ana-apk/_search { "size": 0, "aggs": { "avg_RTPLossRate": { "avg": { "field": "RTPLossRate" } } } }
查询RTPLossRate小于0的值
GET ana-apk/_search { "size": 10, "query": { "range": { "RTPLossRate": { "lt": 0 } } }, "_source":{ "include":["MAC","ProbeOUI","RTPLossRate","message"] } }
查询RTPLossRate大于等于0小于等于1000的值
GET ana-apk/_search { "size": 10, "query": { "range": { "RTPLossRate": { "gte": 0, "lte": 1000 } } }, "aggs": { "avg_RTPLossRate": { "avg": { "field": "RTPLossRate" } } } }
查询RTPLossRate在0到1000之间的数据，并输出字段为OUI的10个值
GET ana-apk/_search { "size": 0, "query": { "range": { "RTPLossRate": { "gte": 0, "lte": 1000 } } }, "aggs": { "NAME": { "terms": { "field": "OUI", "size": 10 } } } }
查询字段OUI包含SKYWORTH的值，并且RTPLossRate的范围在0到1000之间，计算RTPLossRate的平均值
GET ana-apk/_search { "size": 0, "query": { "bool": { "must": [ {"term": { "OUI": { "value": "SKYWORTH" } }}, {"range": { "RTPLossRate": { "gte": 0, "lte": 1000 } }} ] }}, "aggs": { "avg_RTPLossRate": { "avg": { "field": "RTPLossRate" } } } }
支持原创，请移步原文：https://blog.csdn.net/sxf_123456/article/details/78195829???????
es查询，聚合、平均值、值范围、cardinality去重查询
原文：https://www.cnblogs.com/paopao123/p/10749345.html
