elasticsearch查询需求:就是想在一次查询查询出想要的数据,然后分多次按需聚合,减少请求es的次数,减少往返es时间
GET dq_*/_doc/_search
{
"query": {
"bool": {
"must": [
{
"term": {
"header.device.device_type": "device_type111"
}
},
{
"terms": {
"data_type": ["data_type1", "data_type2"] # 相当于MySQL 的 where data_type = 'data_type1' or data_type = 'data_type2'
}
}]
}
},
"aggs": {
"single_cross": {
"terms": {
"field": "cross_id"
},
"aggs": {
"aggs_data_type1": {# 过滤出 data_type == data_type1 的然后找出最新的数据
"terms": {
"field": "data_type",
"size": 1000,
"include": "data_type1"
},
"aggs": {
"lastest_data_type1": {
"max": {
"field": "timestamp_ms"
}
}
}
},"aggs_data_type2": {
# 过滤出 data_type == data_type2 的然后计算平均数
"terms": {
"field": "data_type",
"size": 1000,
"include": "data_type2"
},
"aggs": {
"lastest_data_type2": {
"avg": {
"field": "timestamp_ms"
}
}
}
}
}
}
},
"size": 5
}
{
"query: {}
"aggs" : {
"single_cross_detail": {
"date_histogram": {
"field": "header.timestamp.orig_timestamp_ms",
"interval": "%ss" % interval_time,
# "min_doc_count": 1, # 设置返回的最小文档统计数,过滤掉统计为 0 的区间
# "format": "yyyy-MM-dd HH:mm:ss", # 人性化展示,可选
"time_zone": "+08:00", # 防止时区错乱
}}