elasticsearch学习总结（三） API的使用范例3

最新推荐文章于 2024-09-23 09:08:40 发布

天空win

最新推荐文章于 2024-09-23 09:08:40 发布

阅读量222

点赞数

分类专栏： elasticsearch 文章标签： elasticsearch

本文链接：https://blog.csdn.net/liubowin/article/details/75519973

版权

elasticsearch 专栏收录该内容

11 篇文章 0 订阅

订阅专栏

二、按时间分段统计事件次数

1、Rest api方式

GET /gzns_access/_search
{
"aggs":{
"counts":{
"date_range": {
"field": "@timestamp",
"format":"yyyy-MM-dd HH:mm:ss",
"ranges":[
{
"from":"2017-05-31 00:00:00",
"to":"2017-05-31 23:59:59"
},
{
"from":"2017-06-01 00:00:00",
"to":"2017-06-01 23:59:59"
}
]
}
}
}
}

2、java api方式

public List<ReportViewVO> getTimeRangeList(ReportViewVO param){
SearchRequestBuilder requestbuilder = client.prepareSearch(param.getIndex());

BoolQueryBuilder bqb = QueryBuilders.boolQuery();
String host = param.getHost();
if(StringUtils.isNotEmpty(host))
{
bqb.must(QueryBuilders.termQuery("host", param.getHost()));
}
String type = param.getType();
if(StringUtils.isNotEmpty(type))
{
bqb.must(QueryBuilders.termQuery("_type", param.getHost()));
}
requestbuilder.setQuery(bqb);

//时间区间统计
DateRangeAggregationBuilder aggregation = AggregationBuilders.dateRange("counts").field("@timestamp").format("yyyy-MM-dd HH:mm:ss");
List<TimeRangeVO> timeRanges = param.getTimeRange();
for(TimeRangeVO item : timeRanges){
aggregation.addRange(item.getStart(), item.getEnd());
}
requestbuilder.addAggregation(aggregation);

SearchResponse myresponse = requestbuilder.get();
Map<String, Aggregation> aggMap = myresponse.getAggregations().asMap();
InternalDateRange idr = (InternalDateRange) aggMap.get("counts");
List<InternalDateRange.Bucket> buckets = idr.getBuckets();
List<ReportViewVO> list = new ArrayList<ReportViewVO>();
ReportViewVO item = null;
for(InternalDateRange.Bucket bucket : buckets){
item = new ReportViewVO();

item.setTimestamp(bucket.getKeyAsString());
item.setValue(bucket.getDocCount());
list.add(item);
}
return list;
}