以前我是這樣查詢elasticsearch的：

POST /cdr*/hj_scpcdr/_search
{
  "from" : 0,
  "size" : 0,
  "_source" : {
    "includes" : [ "filedate", "vestss", "permark", "subpp", "SUM" ],
    "excludes" : [ ]
  },
  "fields" : [ "filedate", "vestss", "permark", "subpp" ],
  "sort" : [ {
    "filedate" : {
      "order" :
 
 "asc"
    }
  }, {
    "vestss" : {
      "order" : "asc"
    }
  }, {
    "permark" : {
      "order" : "asc"
    }
  }, {
    "subpp" : {
      "order" : "asc"
    }
  } ],
  "aggregations" : {
    "filedate" : {
      "terms" : {
        "field" : "filedate",
        "size" : 200,
        "order" :
 
 {
          "_term" : "asc"
        }
      },
      "aggregations" : {
        "vestss" : {
          "terms" : {
            "field" : "vestss",
            "size" : 0,
            "order" : {
              "_term" : "asc"
            }
          },
          "aggregations" : {
            "permark"
 
 : {
              "terms" : {
                "field" : "permark",
                "size" : 0,
                "order" : {
                  "_term" : "asc"
                }
              },
              "aggregations" : {
                "subpp" : {
                  "terms" : {
                    "field" : "subpp",
                    "size" : 0,
                    "order" : {
                      "_term" : "asc"
                    }
                  },
                  "aggregations" : {
                    "SUM(calldura60)" : {
                      "sum" : {
                        "field" : "calldura60"
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

但是我現在可以這樣查詢ES了：

POST /_sql
select filedate,vestss,permark,subpp,sum(calldura60)
  from cdr*/hj_scpcdr
 group by filedate,vestss,permark,subpp
 order by filedate,vestss,permark,subpp