日志
Elasticsearch复杂的高聚合DSL语句
查询2017-02-16T06:10:40Z 到 2017-02-16T06:10:50Z 10秒内的字段interval的每秒的最大，最小，平均值，并且统计每秒区间的status各结果集的量。
DSL语句：
GET index/type/_search
{
"size":0,
"aggs": {
"transaction": {
"date_histogram": {
"field": "time",
"interval": "1s",
"extended_bounds" : {
"min" : "2017-02-16T06:10:40Z",
"max" : "2017-02-16T06:10:50Z"
}
},
"aggs":{
"stats_interval": {
"stats": {
"field" : "interval"
}
},
"group_by_status": {
"terms": {
"field" : "status.keyword"
}
}
}
}
},
"query": {
"range": {
"time": {
"from": "2017-02-16T06:10:40Z",
"to" : "2017-02-16T06:10:50Z"
}
}
}
}
输出结果集合：
"aggregations": {
"transaction": {
"buckets": [
{
"key_as_string": "2017-02-16T06:10:40.000Z",
"key": 1487225440000,
"doc_count": 0,
"stats_interval": {
"count": 0,
"min": null,
"max": null,
"avg": null,
"sum": null
},
"group_by_status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": []
}
},
{
"key_as_string": "2017-02-16T06:10:41.000Z",
"key": 1487225441000,
"doc_count": 0,
"stats_interval": {
"count": 0,
"min": null,
"max": null,
"avg": null,
"sum": null
},
"group_by_status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": []
}
},
{
"key_as_string": "2017-02-16T06:10:42.000Z",
"key": 1487225442000,
"doc_count": 0,
"stats_interval": {
"count": 0,
"min": null,
"max": null,
"avg": null,
"sum": null
},
"group_by_status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": []
}
},
{
"key_as_string": "2017-02-16T06:10:43.000Z",
"key": 1487225443000,
"doc_count": 0,
"stats_interval": {
"count": 0,
"min": null,
"max": null,
"avg": null,
"sum": null
},
"group_by_status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": []
}
},
{
"key_as_string": "2017-02-16T06:10:44.000Z",
"key": 1487225444000,
"doc_count": 0,
"stats_interval": {
"count": 0,
"min": null,
"max": null,
"avg": null,
"sum": null
},
"group_by_status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": []
}
},
{
"key_as_string": "2017-02-16T06:10:45.000Z",
"key": 1487225445000,
"doc_count": 0,
"stats_interval": {
"count": 0,
"min": null,
"max": null,
"avg": null,
"sum": null
},
"group_by_status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": []
}
},
{
"key_as_string": "2017-02-16T06:10:46.000Z",
"key": 1487225446000,
"doc_count": 0,
"stats_interval": {
"count": 0,
"min": null,
"max": null,
"avg": null,
"sum": null
},
"group_by_status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": []
}
},
{
"key_as_string": "2017-02-16T06:10:47.000Z",
"key": 1487225447000,
"doc_count": 34,
"stats_interval": {
"count": 34,
"min": 6597,
"max": 35688080,
"avg": 24930241,
"sum": 847628194
},
"group_by_status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "200",
"doc_count": 23
},
{
"key": "0",
"doc_count": 11
}
]
}
},
{
"key_as_string": "2017-02-16T06:10:48.000Z",
"key": 1487225448000,
"doc_count": 46,
"stats_interval": {
"count": 46,
"min": 4426,
"max": 30285530,
"avg": 15098915.652173912,
"sum": 694550120
},
"group_by_status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "200",
"doc_count": 24
},
{
"key": "0",
"doc_count": 22
}
]
}
},
{
"key_as_string": "2017-02-16T06:10:49.000Z",
"key": 1487225449000,
"doc_count": 32,
"stats_interval": {
"count": 32,
"min": 4880,
"max": 19350752,
"avg": 12407199.75,
"sum": 397030392
},
"group_by_status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "200",
"doc_count": 21
},
{
"key": "0",
"doc_count": 11
}
]
}
},
{
"key_as_string": "2017-02-16T06:10:50.000Z",
"key": 1487225450000,
"doc_count": 0,
"stats_interval": {
"count": 0,
"min": null,
"max": null,
"avg": null,
"sum": null
},
"group_by_status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": []
}
}
]
}
}
搜索
复制
