弹性搜索按天计算结果数量。

huangapple go评论130阅读模式
英文:

elastic search count results by day

问题

我有许多Elasticsearch中的日志,需要统计过去10天每天有多少日志。不幸的是,我的JSON代码有问题。您能帮我查找错误吗?提前谢谢!

我需要像下面这样的结果:

日期:记录数
2023-03-17  256
2023-03-18  148

以下是我的JSON代码,其中存在一些错误:

GET /index_name/_search
{
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-11d",
        "lte": "now-1d"
      }
    }
  },
  "aggs" : {
    "byDay" : {
      "date_histogram" : {
        "field" : "@timestamp",
        "calendar_interval" : "1d",
        "format" : "yyyy-MM-dd" 
      }
    }
  }
}

上述执行的结果:

{
   "took": 448,
   "timed_out": false,
   "_shards": {
     "total": 3,
     "successful": 3,
     "skipped": 0,
     "failed": 0
   },
   "hits": {
     "total": {
       "value": 0,
       "relation": "eq"
     },
     "max_score": null,
     "hits": []
   },
   "aggregations": {
     "byDay": {
       "buckets": []
     }
   }
}

我的索引结构如下:

{
   "took": 621,
   "timed_out": false,
   "_shards": {
      "total": 3,
      "successful": 3,
      "skipped": 0,
      "failed": 0
   },
   "hits": {
      "total": {
         "value": 10000,
         "relation": "gte"
      },
      "max_score": 1,
      "hits": [
         {
            "_index": "logs-000001",
            "_id": "FDiUoYYB6jibW4tyO_7l",
            "_score": 1,
            "_source": {
               "@timestamp": "2023-03-02T09:08:08.029Z",
               "qid": "7079B4FEE7",
               "status": "status_A"
            }
         },
         {
            "_index": "logs-000001",
            "_id": "FTiUoYYB6jibW4tyO_7l",
            "_score": 1,
            "_source": {
               "@timestamp": "2023-03-02T09:08:08.057Z",
               "qid": "BE5694FEFB",
               "status": "status_A"
            }
         }
      ]
   }
}
英文:

I have lots of logs in elasticsearch and have to count how many logs I have per one day from last 10 days. Unfortunately my json doesn't work. Could you check where I made mistake? Thanks in advance ! 弹性搜索按天计算结果数量。

I need something like:

date : records
2023-03-17  256
2023-03-18  148

Below is my json with some mistake

GET /index_name/_search
{
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-11d",
        "lte": "now-1d"
      }
    }
  },

    "aggs" : {
        "byDay" : {
            "date_histogram" : {
                "field" : "@timestamp",
                "calendar_interval" : "1d",
                "format" : "yyyy-MM-dd" 
            }
        }
    }
}

result of above execution:

     {
       "took": 448,
       "timed_out": false,
       "_shards": {
         "total": 3,
         "successful": 3,
         "skipped": 0,
         "failed": 0
       },
       "hits": {
         "total": {
           "value": 0,
           "relation": "eq"
         },
         "max_score": null,
         "hits": []
       },
       "aggregations": {
         "byDay": {
           "buckets": []
         }
       }
     }

Structure of my index look like that:

{   "took": 621,   "timed_out": false,   "_shards": {
    "total": 3,
    "successful": 3,
    "skipped": 0,
    "failed": 0   },   "hits": {
    "total": {
      "value": 10000,
      "relation": "gte"
    },
    "max_score": 1,
    "hits": [
      {
        "_index": "logs-000001",
        "_id": "FDiUoYYB6jibW4tyO_7l",
        "_score": 1,
        "_source": {
          "@timestamp": "2023-03-02T09:08:08.029Z",
          "qid": "7079B4FEE7",
          "status": "status_A",
        }
      },
      {
        "_index": "logs-000001",
        "_id": "FTiUoYYB6jibW4tyO_7l",
        "_score": 1,
        "_source": {
          "@timestamp": "2023-03-02T09:08:08.057Z",
          "qid": "BE5694FEFB",
          "status": "status_A",
        }
      }
    ]   
} }

答案1

得分: 0

以下是翻译好的内容:

For your example I increased the range.

{
"size": 0,
"query": {
"range": {
"@timestamp": {
"gte": "now-31d",
"lte": "now-1d"
}
}
},
"aggs": {
"byDay": {
"date_histogram": {
"field": "@timestamp",
"calendar_interval": "1d",
"format": "yyyy-MM-dd"
}
}
}
}

Results:

"aggregations" : {
"byDay" : {
"buckets" : [
{
"key_as_string" : "2023-03-02",
"key" : 1677715200000,
"doc_count" : 2
}
]
}
}

英文:

For your example I increased the range.

{
  "size": 0,
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-31d",
        "lte": "now-1d"
      }
    }
  },
  "aggs": {
    "byDay": {
      "date_histogram": {
        "field": "@timestamp",
        "calendar_interval": "1d",
        "format": "yyyy-MM-dd"
      }
    }
  }
}

Results:

 "aggregations" : {
    "byDay" : {
      "buckets" : [
        {
          "key_as_string" : "2023-03-02",
          "key" : 1677715200000,
          "doc_count" : 2
        }
      ]
    }
  }

huangapple
  • 本文由 发表于 2023年3月31日 04:35:07
  • 转载请务必保留本文链接:https://go.coder-hub.com/75892779.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定