1.分组去重统计,先按照policyName统计每个policyName数量,再安装alarmId统计policyName下面每个alarmId数量。
GET logstash-alarmtimer-logs-2018.10.*/_search
{
"size": 0,
"query": {
"range": {
"ctime": {
"gte": 1540378800000
}
}
},
"aggs": {
"all_alarms": {
"terms": {
"field": "policyName.keyword"
},
"aggs": {
"distinct_alarms": {
"cardinality": {
"field": "alarmId.keyword"
}
}
}
}
}
}
2.分组求和统计,先统计每个policyName的数量,再统计每个policyName下面所有counter求和数值。
GET logstash-alarmtimer-logs-2018.10.*/_search
{
"size": 0,
"query": {
"range": {
"ctime": {
"gte": 1540378800000
}
}
},
"aggs": {
"all_alarms": {
"terms": {
"field": "policyName.keyword"
},
"aggs": {
"sum_alarms": {
"sum": {
"field": "counter"
}
}
}
}
}
}