一、事件统计
1、Rest API实现
GET /gzns_access/_search
{
"aggs":{
"counts":{
"date_histogram": {
"field": "@timestamp",
"format":"yyyy-MM-dd HH:mm",
"interval":"minute"
}
}
}
}
2、java api实现
/**
* 事件统计
* @param param
* @return
*/
public List<ReportViewVO> getEventCountList(ReportViewVO param){
//根据索引查询
SearchRequestBuilder requestbuilder = client.prepareSearch(param.getIndex());
BoolQueryBuilder bqb = QueryBuilders.boolQuery();
//根据服务器过滤
String host = param.getHost();
if(StringUtils.isNotEmpty(host))
{
bqb.must(QueryBuilders.termQuery("host", param.getHost()));
}
//根据类型过滤
String type = param.getType();
if(StringUtils.isNotEmpty(type))
{
bqb.must(QueryBuilders.termQuery("_type", param.getHost()));
}
requestbuilder.setQuery(bqb);
//组装分组,根据@timestamp按时间周期统计次数
DateHistogramAggregationBuilder aggregation = AggregationBuilders.dateHistogram("counts");
aggregation.field("@timestamp");
String interval = param.getInterval();
//统计周期 1y:年,1q:季度,1M:月,1w:周,1d:日,1H:小时,1m:分钟,1s:秒
switch (interval) {
case "1y":
aggregation.dateHistogramInterval(DateHistogramInterval.YEAR);
aggregation.format("yyyy");
break;
case "1q":
aggregation.dateHistogramInterval(DateHistogramInterval.QUARTER);
aggregation.format("yyyy-MM");
break;
case "1M":
aggregation.dateHistogramInterval(DateHistogramInterval.MONTH);
aggregation.format("yyyy-MM");
break;
case "1w":
aggregation.dateHistogramInterval(DateHistogramInterval.WEEK);
aggregation.format("yyyy-MM-dd");
break;
case "1d":
aggregation.dateHistogramInterval(DateHistogramInterval.DAY);
aggregation.format("yyyy-MM-dd");
break;
case "1H":
aggregation.dateHistogramInterval(DateHistogramInterval.HOUR);
aggregation.format("yyyy-MM-dd HH");
break;
case "1m":
aggregation.dateHistogramInterval(DateHistogramInterval.MINUTE);
aggregation.format("yyyy-MM-dd HH:mm");
break;
case "1s":
aggregation.dateHistogramInterval(DateHistogramInterval.HOUR);
aggregation.format("yyyy-MM-dd HH:mm:ss");
break;
default:
break;
}
requestbuilder.addAggregation(aggregation);
//获取查询结果
SearchResponse myresponse = requestbuilder.get();
Map<String, Aggregation> aggMap = myresponse.getAggregations().asMap();
InternalDateHistogram idh = (InternalDateHistogram) aggMap.get("counts");
//获取分组桶数据
List<Bucket> buckets = idh.getBuckets();
//返回的vo结果集
List<ReportViewVO> list = new ArrayList<ReportViewVO>();
ReportViewVO item = null;
for(Bucket bucket : buckets){
item = new ReportViewVO();
//时间
item.setTimestamp(bucket.getKeyAsString());
//事件次数
item.setValue(bucket.getDocCount());
list.add(item);
}
return list;
}