Elasticsearch聚合

最新推荐文章于 2025-02-06 14:54:00 发布

原创最新推荐文章于 2025-02-06 14:54:00 发布 · 695 阅读

2 ·

CC 4.0 BY-SA版权

文章标签：

#elasticsearch

程序demon 专栏收录该内容

2 篇文章

订阅专栏

一、按sum聚合的结果做排序

{
  "query": {
    "match_all": {}
  },
  "aggregations": {
    "leo": {
      "terms": {
        "script": "_source.time.split(' ')[0]+':'+_source.workflow",
        "order": {
          "leo2": "asc"
        }
      },
      "aggregations": {
        "leo2": {
          "sum": {
            "field": "errcode"
          }
        }
      }
    }
  }
}

二、按时间粒度做聚合

//DSL查询语句为:
{
  "query": {
    "match_all": {}
  },
  "aggregations": {
    "agg": {
      "date_histogram": {
        "field": "time",
        "interval": "1h",
        "min_doc_count": 0,
        "format": "yyyy-MM-dd HH:mm:ss"
      },
      "aggregations": {
        "max-userrate": {
          "max": {
            "field": "userrate"
          }
        },
        "max-bandwidthrate": {
          "max": {
            "field": "bandwidthrate"
          }
        },
        "max-spacerate": {
          "max": {
            "field": "spacerate"
          }
        }
      }
    }
  }
}

//二次聚合
{
  "size": 1,
  "query": {
    "match_all": {}
  },
  "aggregations": {
    "agg": {
      "date_histogram": {
        "field": "logtime",
        "interval": "1d",
        "min_doc_count": 0,
        "format": "yyyyMMddHHmmss"
      },
      "aggregations": {
        "agg1": {
          "date_histogram": {
            "field": "logtime",
            "interval": "5m",
            "min_doc_count": 0,
            "format": "yyyyMMddHHmmss"
          }
        }
      }
    }
  }
}

Java API为

        switch(particle)
        {
            case Constant.particle_10m:
                aggregation = AggregationBuilders.dateHistogram("agg")
                                                 .field("time")
                                                 .interval(DateHistogram.Interval.minutes(10))
                                                 .format("yyyy-MM-dd HH:mm:ss")
                                                 .minDocCount(0);
                break;
            case Constant.particle_1h:
                aggregation = AggregationBuilders.dateHistogram("agg")
                                                 .field("time")
                                                 .interval(DateHistogram.Interval.HOUR)
                                                 .format("yyyy-MM-dd HH:mm:ss")
                                                 .minDocCount(0);
                break;
            case Constant.particle_1d:
                aggregation = AggregationBuilders.dateHistogram("agg")
                                                 .field("time")
                                                 .interval(DateHistogram.Interval.DAY)
                                                 .format("yyyy-MM-dd HH:mm:ss")
                                                 .minDocCount(0);
                break;
            case Constant.particle_1w:
                aggregation = AggregationBuilders.dateHistogram("agg")
                                                 .field("time")
                                                 .interval(DateHistogram.Interval.WEEK)
                                                 .format("yyyy-MM-dd HH:mm:ss")
                                                 .minDocCount(0);
                break;
            case Constant.particle_1M:
                aggregation = AggregationBuilders.dateHistogram("agg")
                                                 .field("time")
                                                 .interval(DateHistogram.Interval.MONTH)
                                                 .format("yyyy-MM-dd HH:mm:ss")
                                                 .minDocCount(0);
                break;
            case Constant.particle_1s:
                aggregation = AggregationBuilders.dateHistogram("agg")
                                                 .field("time")
                                                 .interval(DateHistogram.Interval.QUARTER)
                                                 .format("yyyy-MM-dd HH:mm:ss")
                                                 .minDocCount(0);
                break;
            default:
        }

三、按时间粒度做双重聚合后按sum排序

{
  "size": 0,
  "query": {
    "match_all": {}
  },
  "aggregations": {
    "agg1": {
      "date_histogram": {
        "field": "logtime",
        "interval": "1d",
        "min_doc_count": 0,
        "format": "yyyy-MM-dd HH:mm:ss"
      },
      "aggregations": {
        "agg2": {
          "date_histogram": {
            "field": "logtime",
            "interval": "5m",
            "min_doc_count": 0,
            "format": "yyyy-MM-dd HH:mm:ss",
            "order":{
               "leo2":"asc"
            }
          },
          "aggregations": {
          "leo2": {
            "sum": {
              "field": "totalsum"
            }
          }
         }
        }
      }
    }
  }
}