我要查询聚合后最小的‘first_seen'值，应该怎样修改下面的代码： query_body = { # "query": { # "bool": { # "must": [ # {"match": {"malware_name.raw": family_name}} # ] # } # }, # "_source" : ["first_seen"], # "size" : 5 "query": { "bool": { "must": [], "filter": [ { "bool": { "should": [ { "match_phrase": { "malware_name": family_name } } ], "minimum_should_match": 1 } } ] } }, "_source" : ["first_seen"], # "size" : 1 "aggs": { "min_my_field": { "min": { "field": "first_seen" } } } } index = "basic.virusname" # hits = helpers.scan(es,index=index, query=query_body) hits = es.search(index=index, body=query_body) print(hits) for hit in hits: fw.write(family_name + " " + str(hit['_source']['first_seen']) +"\r")

要查询聚合后最小的 'first_seen' 值，你需要将代码中的注释去掉，并对以下部分进行修改：

1. 在 query_body 中的 "aggs" 字段下添加一个聚合查询，使用 "min" 聚合器来计算最小值：

"aggs": {
    "min_my_field": {
        "min": {
            "field": "first_seen"
        }
    }
}

2. 将 size 参数设置为 0，以便只返回聚合结果而不返回具体的文档：

"size": 0

3. 在循环遍历结果之前，通过 `hits['aggregations']['min_my_field']['value']` 来获取聚合后的最小值：

min_first_seen = hits['aggregations']['min_my_field']['value']

完整的修改后的代码如下：

query_body = {
    "query": {
        "bool": {
            "must": [],
            "filter": [
                {
                    "bool": {
                        "should": [
                            {
                                "match_phrase": {
                                    "malware_name": family_name
                                }
                            }
                        ],
                        "minimum_should_match": 1
                    }
                }
            ]
        }
    },
    "_source" : ["first_seen"],
    "size" : 0,
    "aggs": {
        "min_my_field": {
            "min": {
                "field": "first_seen"
            }
        }
    }
}
index = "basic.virusname"

hits = es.search(index=index, body=query_body)
min_first_seen = hits['aggregations']['min_my_field']['value']

print(min_first_seen)

for hit in hits:
    fw.write(family_name + " " + str(hit['_source']['first_seen']) +"\r")

这样修改后，你将能够获取到聚合后的最小的 'first_seen' 值。