三、按字段分类统计
1、rest api方式
GET /gzns_access/_search
{
"aggs":{
"group_count":{
"terms": {
"field": "request.keyword"
}
}
}
}
2、java api方式
public List<ReportViewVO> getFieldGroupList(ReportViewVO param){
SearchRequestBuilder requestbuilder = client.prepareSearch(param.getIndex());
BoolQueryBuilder bqb = QueryBuilders.boolQuery();
String host = param.getHost();
if(StringUtils.isNotEmpty(host))
{
bqb.must(QueryBuilders.termQuery("host", param.getHost()));
}
String type = param.getType();
if(StringUtils.isNotEmpty(type))
{
bqb.must(QueryBuilders.termQuery("_type", param.getHost()));
}
requestbuilder.setQuery(bqb);
//字段分类统计
requestbuilder.addAggregation(AggregationBuilders.terms("group_count").field(param.getField()+".keyword"));
SearchResponse myresponse = requestbuilder.get();
Map<String, Aggregation> aggMap = myresponse.getAggregations().asMap();
StringTerms st = (StringTerms)aggMap.get("group_count");
List<Terms.Bucket> buckets = st.getBuckets();
List<ReportViewVO> list = new ArrayList<ReportViewVO>();
ReportViewVO item = null;
for(Terms.Bucket bucket : buckets){
item = new ReportViewVO();
item.setField(bucket.getKeyAsString());
item.setValue(bucket.getDocCount());
list.add(item);
}
return list;
}