以下是一个可能的Elasticsearch查询：
```
POST parter_upgrade_scs_saas_main.video_traffic_record/_search
{
"_source": ["id", "domain_name", "vpn_user", "ip_address", "http_port", "time", "estime"],
"query": {
"bool": {
"must": [
{
"exists": {
"field": "estime"
}
}
]
}
},
"aggs": {
"group_by": {
"composite": {
"size": 1000,
"sources": [
{
"domain_name": {
"terms": {
"field": "domain_name"
}
}
},
{
"http_port": {
"terms": {
"field": "http_port"
}
}
},
{
"date": {
"date_histogram": {
"field": "time",
"calendar_interval": "day",
"format": "yyyy-MM-dd"
}
}
}
]
},
"aggs": {
"id": {
"top_hits": {
"size": 1,
"_source": ["id"]
}
},
"vpn_user": {
"top_hits": {
"size": 1,
"_source": ["vpn_user"]
}
},
"ip_address": {
"top_hits": {
"size": 1,
"_source": ["ip_address"]
}
},
"happenTime": {
"top_hits": {
"size": 1,
"_source": {
"script": {
"source": "doc['time'].value.toInstant().atZone(ZoneId.of('Asia/Shanghai')).format(DateTimeFormatter.ofPattern('yyyy-MM-dd HH:mm:ss'))"
}
}
}
},
"deviceID": {
"terms": {
"field": "deviceID"
}
},
"systemType": {
"terms": {
"field": "systemType"
}
},
"devTypeID": {
"terms": {
"field": "devTypeID"
}
},
"location": {
"top_hits": {
"size": 1,
"_source": ["location"],
"script_fields": {
"location": {
"script": {
"source": "doc['location'].value"
}
}
}
}
},
"referenceName": {
"top_hits": {
"size": 1,
"_source": {
"script": {
"source": "doc['location'].value != null ? doc['location'].value : ''"
}
},
"script_fields": {
"referenceName": {
"script": {
"source": "def location = doc['location'].value != null ? doc['location'].value : ''; def parts = location.split('/'); parts.length > 0 ? parts[0] : ''"
}
}
}
}
},
"partyUnitName": {
"top_hits": {
"size": 1,
"_source": {
"script": {
"source": "doc['deviceID'].value != null ? doc['deviceID'].value : ''"
}
},
"script_fields": {
"partyUnitName": {
"script": {
"source": "def deviceID = doc['deviceID'].value != null ? doc['deviceID'].value : ''; def parts = deviceID.split('_'); parts.length > 0 ? parts[0] : ''"
}
}
}
}
},
"safetyGearName": {
"top_hits": {
"size": 1,
"_source": {
"script": {
"source": "doc['deviceID'].value != null ? doc['deviceID'].value : ''"
}
},
"script_fields": {
"safetyGearName": {
"script": {
"source": "def deviceID = doc['deviceID'].value != null ? doc['deviceID'].value : ''; def parts = deviceID.split('_'); parts.length > 1 ? parts[1] : ''"
}
}
}
}
}
}
}
}
}
```
这个查询会按照`domain_name`，`http_port`和日期分组，同时在每个组内找到满足`estime`字段存在的文档，并从中提取所需的字段。其中，`happenTime`字段使用脚本来将UNIX时间戳转换为本地时间，`location`字段使用脚本来提取其中的第一部分作为`referenceName`，`deviceID`字段使用脚本来提取其中的第一部分作为`partyUnitName`，提取第二部分作为`safetyGearName`。
请注意，这个查询可能需要根据您的数据模型和查询需求进行适当的调整。
6800
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
