分组依据的 Elasticsearch 聚合，然后获取最大日期的字段平均值

我从你的问题中了解到，你想要每个部门最新记录日期的平均风险指数。

可以使用术语聚合找到最大值。即;

1. 在必填字段上使用术语聚合
2. 按降序对术语键进行排序 "order": { "_key": "desc" }
3. 说 size = 1 只获得一个最高值。 （这将是最大值）

"aggs": {
   "maxKey": {
      "terms": {
         "field": "<field whose max is required>","size": 1,"order": {
            "_key": "desc"
          }
       }
   }
}

我认为，下面是您要查找的查询。

{
  "size": 0,"aggs": {
    "EachDepartment": {
      "terms": {
        "field": "department_name","size": 1000
      },"aggs": {
        "MaxRecordDate": {
          "terms": {
            "field": "record_date","order": {
              "_key": "desc"
            }
          },"aggs": {
            "AvgOfRiskIndex": {
              "avg": {
                "field": "risk_index_value"
              }
            }
          }
        }
      }
    }
  }
}

我尝试使用您提供的示例数据执行此操作并得到以下响应。

{
  "aggregations" : {
    "EachDepartment" : {
      "doc_count_error_upper_bound" : 0,"sum_other_doc_count" : 0,"buckets" : [
        {
          "key" : "A","doc_count" : 5,"MaxRecordDate" : {
            "doc_count_error_upper_bound" : 0,"sum_other_doc_count" : 2,"buckets" : [
              {
                "key" : 1619568000000,"key_as_String" : "2021-04-28 00:00:00","doc_count" : 3,"AvgOfRiskIndex" : {
                  "value" : 20.0
                }
              }
            ]
          }
        },{
          "key" : "B","AvgOfRiskIndex" : {
                  "value" : 220.0
                }
              }
            ]
          }
        },{
          "key" : "C","doc_count" : 1,"AvgOfRiskIndex" : {
                  "value" : 45.0
                }
              }
            ]
          }
        }
      ]
    }
  }
}

我希望这能回答您的问题。

编辑：添加了 RestHighLevelClient 代码以创建聚合

AggregationBuilder getAggsBuilder() {
    AggregationBuilder departmentAggs = AggregationBuilders.terms("eachDepartments")
                .field("department_name")
                .size(1000);
    AggregationBuilder maxRecordDateAgg = AggregationBuilders.terms("maxRecordDate")
                .field("record_date")
                .size(1)
                .order(BucketOrder.key(false));
    AggregationBuilder avgRiskIndexAgg = AggregationBuilders.avg("avgRiskIndex")
                .field("risk_index_value");

// add avgRiskIndexAgg to maxRecordDate
    maxRecordDateAgg.subAggregation(avgRiskIndexAgg);

//add maxRecordDate to departmentAggs
    departmentAggs.subAggregation(maxRecordDateAgg);
    return departmentAggs;
}