kibana json input里使用自定义脚本

前置条件

inline script默认是不开启的
在config/elasticsearch.yml中加入

script.inline: true
script.indexed: true

官方文档:

https://www.elastic.co/guide/en/elasticsearch/guide/current/script-score.html
https://www.elastic.co/guide/en/elasticsearch/reference/2.3/modules-scripting.html

示例:

{ 
	"script": {
		"lang": "painless",
		"inline": "params.tmp=(_value-doc['aaa'].value)/doc['aaa'].value;if(params.min>params.tmp){params.min=params.tmp}if(params.max<params.tmp){params.max=params.tmp}return params.max-params.min",
		"params": {
			"tmp":0,
			"min": 0,
			"max":0
		}
	}
}

然后对字段进行sum聚合,就可以统计出>0的项多少个
*注: 只有数字字段才可以在doc[‘xx’]中访问

内置函数

https://www.elastic.co/guide/en/elasticsearch/guide/current/script-score.html

语法文档

http://cwiki.apachecn.org/pages/viewpage.action?pageId=10027215