Elasticsearch聚合

最新推荐文章于 2023-11-15 09:25:14 发布

Forrestleo

最新推荐文章于 2023-11-15 09:25:14 发布

阅读量588

点赞数

文章标签： elasticsearch

本文链接：https://blog.csdn.net/Forrestleo/article/details/72898208

版权

程序demon 专栏收录该内容

2 篇文章 0 订阅

订阅专栏

一、按sum聚合的结果做排序

{
  "query": {
    "match_all": {}
  },
  "aggregations": {
    "leo": {
      "terms": {
        "script": "_source.time.split(' ')[0]+':'+_source.workflow",
        "order": {
          "leo2": "asc" }
      },
      "aggregations": {
        "leo2": {
          "sum": { "field": "errcode" } }
      }
    }
  }
}

二、按时间粒度做聚合

//DSL查询语句为:
{
  "query": {
    "match_all": {}
  },
  "aggregations": {
    "agg": {
      "date_histogram": {
        "field": "time",
        "interval": "1h",
        "min_doc_count": 0,
        "format": "yyyy-MM-dd HH:mm:ss"
      },
      "aggregations": {
        "max-userrate": {
          "max": {
            "field": "userrate"
          }
        },
        "max-bandwidthrate": {
          "max": {
            "field": "bandwidthrate"
          }
        },
        "max-spacerate": {
          "max": {
            "field": "spacerate"
          }
        }
      }
    }
  }
}

//二次聚合
{
  "size": 1,
  "query": {
    "match_all": {}
  },
  "aggregations": {
    "agg": {
      "date_histogram": {
        "field": "logtime",
        "interval": "1d",
        "min_doc_count": 0,
        "format": "yyyyMMddHHmmss"
      },
      "aggregations": {
        "agg1": {
          "date_histogram": {
            "field": "logtime",
            "interval": "5m",
            "min_doc_count": 0,
            "format": "yyyyMMddHHmmss"
          }
        }
      }
    }
  }
}

Java API为

        switch(particle)
        {
            case Constant.particle_10m:
                aggregation = AggregationBuilders.dateHistogram("agg")
                                                 .field("time")
                                                 .interval(DateHistogram.Interval.minutes(10))
                                                 .format("yyyy-MM-dd HH:mm:ss")
                                                 .minDocCount(0);
                break;
            case Constant.particle_1h:
                aggregation = AggregationBuilders.dateHistogram("agg")
                                                 .field("time")
                                                 .interval(DateHistogram.Interval.HOUR)
                                                 .format("yyyy-MM-dd HH:mm:ss")
                                                 .minDocCount(0);
                break;
            case Constant.particle_1d:
                aggregation = AggregationBuilders.dateHistogram("agg")
                                                 .field("time")
                                                 .interval(DateHistogram.Interval.DAY)
                                                 .format("yyyy-MM-dd HH:mm:ss")
                                                 .minDocCount(0);
                break;
            case Constant.particle_1w:
                aggregation = AggregationBuilders.dateHistogram("agg")
                                                 .field("time")
                                                 .interval(DateHistogram.Interval.WEEK)
                                                 .format("yyyy-MM-dd HH:mm:ss")
                                                 .minDocCount(0);
                break;
            case Constant.particle_1M:
                aggregation = AggregationBuilders.dateHistogram("agg")
                                                 .field("time")
                                                 .interval(DateHistogram.Interval.MONTH)
                                                 .format("yyyy-MM-dd HH:mm:ss")
                                                 .minDocCount(0);
                break;
            case Constant.particle_1s:
                aggregation = AggregationBuilders.dateHistogram("agg")
                                                 .field("time")
                                                 .interval(DateHistogram.Interval.QUARTER)
                                                 .format("yyyy-MM-dd HH:mm:ss")
                                                 .minDocCount(0);
                break;
            default:
        }

三、按时间粒度做双重聚合后按sum排序

{
  "size": 0,
  "query": {
    "match_all": {}
  },
  "aggregations": {
    "agg1": {
      "date_histogram": {
        "field": "logtime",
        "interval": "1d",
        "min_doc_count": 0,
        "format": "yyyy-MM-dd HH:mm:ss"
      },
      "aggregations": {
        "agg2": {
          "date_histogram": { "field": "logtime", "interval": "5m", "min_doc_count": 0, "format": "yyyy-MM-dd HH:mm:ss", "order":{ "leo2":"asc" } },
          "aggregations": { "leo2": { "sum": { "field": "totalsum" } } } }
      }
    }
  }
}