Elasticsearch使用filter聚合实现条件求和的写法校验

需求为统计Elasticsearch中state字段不等于Cancelled的所有记录的total_stake字段总和，当前编写的filter聚合执行后返回全量数据总和，过滤未生效，原有代码如下：

SumAggregationBuilder sumOfTotalStake = AggregationBuilders.sum(TOTAL_STAKE).field(TOTAL_STAKE);
BoolQueryBuilder bqb = boolQuery().mustNot(termQuery("state", "Cancelled"));

// create the filter aggregation and add the sub-aggregation
FilterAggregationBuilder aggregation = AggregationBuilders.filter(TOTAL_STAKE+"New", bqb).subAggregation(sumOfTotalStake);

示例数据包含state、total_stake等核心字段，state字段存在Cancelled类状态值。

失效原因 #

两个最常见的触发场景：

• 取值逻辑错误：sum聚合是filter聚合的子聚合，若直接从搜索响应的根聚合节点取sum结果，拿到的不是filter过滤范围内的计算值，会返回全局统计结果。
• 聚合未正确挂载到请求：仅构建FilterAggregationBuilder对象，未将其添加到SearchSourceBuilder的聚合配置中，ES默认执行matchAll全量查询，自然返回全量总和。

修正方案 #

方案1：沿用Filter聚合思路（适合多子聚合并行统计场景） #

修正后完整可运行代码：

// 构建过滤逻辑与聚合，注意聚合名不要和字段名重名，避免key冲突
SumAggregationBuilder sumOfTotalStake = AggregationBuilders.sum("valid_total_stake").field(TOTAL_STAKE);
BoolQueryBuilder filterQuery = boolQuery().mustNot(termQuery("state", "Cancelled"));
FilterAggregationBuilder filterAgg = AggregationBuilders
        .filter("exclude_cancelled_filter", filterQuery)
        .subAggregation(sumOfTotalStake);

// 组装查询请求，size设为0不返回命中文档，大幅提升查询性能
SearchRequest searchRequest = new SearchRequest("你的索引名");
SearchSourceBuilder sourceBuilder = new SearchSourceBuilder();
sourceBuilder.size(0);
sourceBuilder.aggregation(filterAgg);
searchRequest.source(sourceBuilder);

// 执行查询，注意取值顺序：先取filter聚合结果，再取内部嵌套的sum结果
SearchResponse response = client.search(searchRequest, RequestOptions.DEFAULT);
Filter filterRes = response.getAggregations().get("exclude_cancelled_filter");
Sum sumRes = filterRes.getAggregations().get("valid_total_stake");
double total = sumRes.getValue();

方案2：直接在Query层过滤（单统计场景下性能更优，推荐） #

如果不需要同时统计其他过滤维度的结果，没必要嵌套filter聚合，直接把过滤条件放到主查询里，减少聚合嵌套层级，查询效率更高：

// 主查询直接过滤掉state=Cancelled的文档
BoolQueryBuilder baseQuery = boolQuery().mustNot(termQuery("state", "Cancelled"));
SumAggregationBuilder sumAgg = AggregationBuilders.sum("valid_total_stake").field(TOTAL_STAKE);

SearchSourceBuilder sourceBuilder = new SearchSourceBuilder();
sourceBuilder.query(baseQuery);
sourceBuilder.size(0);
sourceBuilder.aggregation(sumAgg);

SearchRequest searchRequest = new SearchRequest("你的索引名").source(sourceBuilder);
SearchResponse response = client.search(searchRequest, RequestOptions.DEFAULT);
// 直接从根节点取sum结果即可
Sum sumRes = response.getAggregations().get("valid_total_stake");
double total = sumRes.getValue();

额外排查点 #

如果以上调整后过滤依然不生效，检查state字段的映射：

• 若state是text类型，term查询匹配的是分词后的词项，可能无法精确匹配到完整字符串Cancelled，此时需要将查询字段改为state.keyword，或者调整字段映射为keyword类型存储枚举类状态值。

内容的提问来源于stack exchange，提问作者Debasish Halder