有没有办法对最新的n个记录进行聚合?
这个解决方案不起作用
{
"query": {...},
"size": N,
"order": ...,
"aggs": {
....
}
}
有关更多详细信息:我想从“服务名称”字段为“x”的记录中获取最后10条记录,然后对这10条记录进行聚合,以找出其中有多少条记录在“响应代码”字段中“成功”。
我的数据是这样的:
[
{
"_index": "logs",
"_type": "_doc",
"_id": "1232525",
"_score": 1,
"_source": {
"resp_body": "",
"client_ip": "127.0.0.1",
"resp_time": "2021-04-15T10:24:51+01:00",
"@timestamp": "2021-04-15T05:55:00.452Z",
"resp_code": "412",
"service_name": "service1",
"log_id": "1232525"
}
},
{
"_index": "logs",
"_type": "_doc",
"_id": "1232524",
"_score": 1,
"_source": {
"resp_body": "",
"client_ip": "127.0.0.1",
"resp_time": "2021-04-15T10:23:51+01:00",
"@timestamp": "2021-04-15T05:53:00.452Z",
"resp_code": "0",
"service_name": "service2",
"log_id": "1232524"
}
},
{
"_index": "logs",
"_type": "_doc",
"_id": "1232523",
"_score": 1,
"_source": {
"resp_body": "",
"client_ip": "127.0.0.1",
"resp_time": "2021-04-15T10:22:51+01:00",
"@timestamp": "2021-04-15T05:52:00.452Z",
"resp_code": "0",
"service_name": "service1",
"log_id": "1232523"
}
},
{
"_index": "logs",
"_type": "_doc",
"_id": "1232522",
"_score": 1,
"_source": {
"resp_body": "",
"client_ip": "127.0.0.1",
"resp_time": "2021-04-15T10:21:51+01:00",
"@timestamp": "2021-04-15T05:51:00.452Z",
"resp_code": "0",
"service_name": "service1",
"log_id": "1232522"
}
},
{
"_index": "logs",
"_type": "_doc",
"_id": "1232521",
"_score": 1,
"_source": {
"resp_body": "",
"client_ip": "127.0.0.1",
"resp_time": "2021-04-15T10:20:51+01:00",
"@timestamp": "2021-04-15T05:50:00.452Z",
"resp_code": "0",
"service_name": "service2",
"log_id": "1232521"
}
}
]
例如:我想得到最后2条“service\u name=service1”的记录,并找出其中有多少条“resp\u code=0”
1条答案
按热度按时间ifsvaxew1#
您需要使用术语聚合、过滤器聚合和最大聚合的组合来实现所需的结果。
使用筛选器聚合(
first_filter
),首先,过滤这些文档"service_name=service1"
然后使用术语聚合(top_terms_aggregation
)创建基于log_id
现场。这些桶是分类的desc
订单基于@timestamp
字段(使用最大聚合)再次使用过滤器聚合(
second_filter
),这些文档被过滤掉"resp_code=0"
添加一个工作示例,包括索引Map、数据(与问题相同)、搜索查询和搜索结果索引Map:
搜索查询:
搜索结果: