elasticsearch:按时间戳过滤的聚合

cczfrluj  于 2021-06-14  发布在  ElasticSearch
关注(0)|答案(1)|浏览(309)

我需要一个特定日期的不同ID列表。我正在尝试将“聚合”与“过滤”结合使用。试过几种方法,但都不管用。正确的格式是什么?

{
    "size": "1000",
    "_source": ["Id"],
    "query": {
      "range": {
        "@timestamp": {
          "gte": "2020-10-20T00:00:00",
          "lt": "2020-10-21T00:00:00"
        }
      }
    },
     "aggs": {
      "ids": {
        "terms": { "field": "Id.keyword" }
      }
    }
  }

我试过的另一种方法是:

{
    "size": "1000",
    "_source": ["Id"],
     "aggs": {
      "ids": {
        "filter": {
          "range": {
            "@timestamp": {
              "gte": "2020-10-20T00:00:00",
              "lt": "2020-10-21T00:00:00"
            }
          }
        },
        "terms": { "field": "Id.keyword" }
      }
    }
  }

这里是@timestampMap:

"@timestamp": {
   "type": "date",
   "format": "dateOptionalTime"
 }
b1payxdu

b1payxdu1#

实际上,第一种选择几乎是正确的。您只需要在查询中将size设置为0,然后删除 _source 因为您不需要它,所以在术语“聚合”中将“大小”设置为1000:

{
  "size": "0",
  "query": {
    "range": {
      "@timestamp": {
        "gte": "2020-10-20T00:00:00",
        "lt": "2020-10-21T00:00:00"
      }
    }
  },
  "aggs": {
    "ids": {
      "terms": {
        "field": "Id.keyword",
        "size": 1000
      }
    }
  }
}

相关问题