博客

统计访问超5000的ulr有多少个(

sum的最大值会小于等于size，因此size的预估很重要

)

GET /logstash-2018.03.27/_search?
{
   "size": 0,
   "aggs": {
      "all_terms": {
         "terms": {
            "field": "url_regex",
            "size": 30,
             "min_doc_count": 5000
         },
         "aggs": {
            "distinct_url": {
               "cardinality": { 
                  "field": "url_regex"
               }
            }
         }
      },
      "sum_of_rul": {
         "sum_bucket": {
            "buckets_path": "all_terms>distinct_url.value"
         }
      }
   }
}