彈性搜索：在聚集

彈性搜索選擇多個vlaues我有「allocated_bytes」，「TOTAL_BYTES」等領域的下列指標：彈性搜索：在聚集

{ 
    "_index" : "metrics-blockstore_capacity-2017_06", 
    "_type" : "datapoint", 
    "_id" : "AVzHwgsi9KuwEU6jCXy5", 
    "_score" : 1.0, 
    "_source" : { 
    "timestamp" : 1498000001000, 
    "resource_guid" : "2185d15c-5298-44ac-8646-37575490125d", 
    "allocated_bytes" : 1.159196672E9, 
    "resource_type" : "machine", 
    "total_bytes" : 1.460811776E11, 
    "machine" : "2185d15c-5298-44ac-8646-37575490125d" 
    }

我有以下查詢 1）拿到一分間隔30分鐘，使用日期直方圖 2）group by resource_guid。 3）最大聚合來查找最大值。

{ 
    "size": 0, 
    "query": { 
    "bool": { 
    "must": [ 
    { 
     "range": { 
     "timestamp": { 
      "gte": 1497992400000, 
      "lte": 1497996000000 
     } 
     } 
    } 
    ] 
} 
}, 
"aggregations": { 
"groupByTime": { 
    "date_histogram": { 
    "field": "timestamp", 
    "interval": "30m", 
    "order": { 
     "_key": "desc" 
    } 
    }, 
    "aggregations": { 
    "groupByField": { 
     "terms": { 
     "size": 1000, 
     "field": "resource_guid" 
     }, 
     "aggregations": { 
     "maxValue": { 
      "max": { 
      "field": "allocated_bytes" 
      } 
     } 
     } 
    }, 
    "sumUnique": { 
     "sum_bucket": { 
     "buckets_path": "groupByField>maxValue" 
     } 
    } 
    } 
}

}}

但與此查詢我能夠得到的只有allocated_bytes，但我需要的結果點同時具有allocated_bytes和TOTAL_BYTES。

下面是從上述查詢結果：

{ 
    "key_as_string" : "2017-06-20T21:00:00.000Z", 
    "key" : 1497992400000, 
    "doc_count" : 9, 
    "groupByField" : { 
     "doc_count_error_upper_bound" : 0, 
     "sum_other_doc_count" : 0, 
     "buckets" : [ { 
     "key" : "2185d15c-5298-44ac-8646-37575490125d", 
     "doc_count" : 3, 
     "maxValue" : { 
      "value" : 1.156182016E9 
     } 
     }, { 
     "key" : "c3513cdd-58bb-4f8e-9b4c-467230b4f6e2", 
     "doc_count" : 3, 
     "maxValue" : { 
      "value" : 1.156165632E9 
     } 
     }, { 
     "key" : "eff13403-9737-4d08-9dca-fb6c12c3a6fa", 
     "doc_count" : 3, 
     "maxValue" : { 
      "value" : 1.156182016E9 
     } 
     } ] 
    }, 
    "sumUnique" : { 
     "value" : 3.468529664E9 
    } 
    }

我兩樣都需要allocated_bytes和TOTAL_BYTES。我如何獲得每個點的多個字段（allocated_bytes，total_bytes）？

例如：

"sumUnique" : { 
     "Allocatedvalue" : 3.468529664E9, 
     "TotalValue" : 9.468529664E9 
    }

或像這樣：

"allocatedBytessumUnique" : { 
     "value" : 3.468529664E9 
    } 
"totalBytessumUnique" : { 
     "value" : 9.468529664E9 
    },

來源

2017-06-22 katya

您可以添加另一聚集：

{ 
    "size": 0, 
    "query": { 
    "bool": { 
     "must": [ 
     { 
      "range": { 
      "timestamp": { 
       "gte": 1497992400000, 
       "lte": 1497996000000 
      } 
      } 
     } 
     ] 
    } 
    }, 
    "aggregations": { 
    "groupByTime": { 
     "date_histogram": { 
     "field": "timestamp", 
     "interval": "30m", 
     "order": { 
      "_key": "desc" 
     } 
     }, 
     "aggregations": { 
     "groupByField": { 
      "terms": { 
      "size": 1000, 
      "field": "resource_guid" 
      }, 
      "aggregations": { 
      "maxValueAllocated": { 
       "max": { 
       "field": "allocated_bytes" 
       } 
      }, 
      "maxValueTotal": { 
       "max": { 
       "field": "total_bytes" 
       } 
      } 
      } 
     }, 
     "sumUniqueAllocatedBytes": { 
      "sum_bucket": { 
      "buckets_path": "groupByField>maxValueAllocated" 
      } 
     }, 
     "sumUniqueTotalBytes": { 
      "sum_bucket": { 
      "buckets_path": "groupByField>maxValueTotal" 
      } 
     } 
     } 
    } 
    } 
}

我希望大家都知道，sum_bucket計算兄弟聚合只，在這種情況下給出最大值的總和，而不是total_bytes的總和。如果你想得到total_bytes的總和，你可以使用sum aggregation

來源

2017-06-22 10:24:52 Max

彈性搜索：在聚集

回答

相關問題