# 按照关键词word分组,再更具关键字分组(或者可以做其他操作,例如求平均值avg)
GET /tmpl-word-log*/_search
{
  "size": 0,
  "aggs": {
    "group_by_word": {
      "terms": {
        "field": "word.keyword",
        "size": 10
      },
      "aggs": {
        "group_by_timestamp": {
          "terms": {
            "field": "character.keyword"
          }
        }
      }
    }
  }
}


# 先按时间分组,在根据word的种类聚合(可以只设置一个时间段,来查询某个时间段的数据)
# "gte"和"lte"可以换成"from""to"
GET /tmpl-word-log*/_search
{
  "size": 0,
  "aggs": {
    "group_by_timestamp": {
      "range": {
        "field": "@timestamp",
        "ranges": [
          {
            "lt": "2018-09-12T00:00:00.000+0800"
          },
          { 
            "gte": "2018-09-10T00:00:00.000+0800",
            "lte": "2018-09-16T00:00:00.000+0800"
          },
          { 
            "gt": "2018-09-16T00:00:00.000+0800"
          }
        ]
      },
      "aggs": {
        "group_by_word": {
          "terms": {
            "field": "word.keyword",
            "size": 10
          }
        }
      }
    }
  }
}

# 查询关键字是中秋快乐且状态是成功的数据,phoneSerno对数据进行分组
# 还可以加上"must_not","should","filter"等逻辑
GET /tmpl-word-log*/_search
{
  "query": {
    "bool": {
      "must": [
        {"term": {
            "word.keyword": "中秋快乐"
        }},
        {"term": {
            "status.keyword": "SUCCESS"
        }
        }
      ],
      "must_not": [
        {}
      ],
      "should": [
        {}
      ],
      "filter": {}
    }
  }
}

# 根据包名,时间过滤出数据,统计关键词PhoneSerno去重后的数量
GET /sonic-log*/_search
{
  "size": 0,
  "query":{
    "bool":{
      "must": {
        "bool":{
          "should": [
            {"match": {"sonic.appName": "com.soundbus.sharebus"}},
            {"match": {"sonic.appName": "cn.soundbus.sdx"}}]
        }}
    }
},
    "aggs": {
      "range":{
          "date_range":{
          "field":"@timestamp",
          "time_zone": 8,
          "ranges":[{
            "from":"2018-10-08T00:00:00.000",
            "to":"2018-10-08T23:59:59.000"
            }]
        },
        "aggs": {
            "distinc_sonic.phoneSerno": {
            "cardinality": {
            "field": "sonic.phoneSerno.keyword"
          }
          }}
      }
  }
  }