管道聚合

本章定位：管道聚合（Pipeline Aggregations）不是对文档直接聚合，而是对其他聚合的结果进行二次计算。

定义与作用

管道聚合分为两类：

Parent：对父聚合的输出做计算（如 avg_bucket、max_bucket、sum_bucket）
Sibling：对同级聚合的输出做计算（如 derivative、moving_avg、cumulative_sum）

完整示例：杨英的月度趋势分析

POST /courses/_search
{
  "size": 0,
  "aggs": {
    "per_month": {
      "date_histogram": { "field": "publish_date", "calendar_interval": "month" },
      "aggs": { "total_enrollment": { "sum": { "field": "enrollment_count" } } }
    },
    "avg_monthly_enrollment": { "avg_bucket": { "buckets_path": "per_month>total_enrollment" } },
    "max_monthly_enrollment": { "max_bucket": { "buckets_path": "per_month>total_enrollment" } }
  }
}

cumulative_sum 累加趋势

POST /courses/_search
{
  "size": 0,
  "aggs": {
    "per_month": {
      "date_histogram": { "field": "publish_date", "calendar_interval": "month" },
      "aggs": {
        "monthly_enrollment": { "sum": { "field": "enrollment_count" } },
        "cumulative_enrollment": { "cumulative_sum": { "buckets_path": "monthly_enrollment" } }
      }
    }
  }
}

小结

管道聚合 = 对聚合结果的二次计算。痛点场景："平均每月多少⇒avg_bucket"、"增长趋势⇒derivative"。buckets_path 语法支持单桶路径和 >meta 访问。