Elasticsearch聚合截断小数。

huangapple go评论62阅读模式
英文:

elasticsearch aggregations truncates decimals

问题

这是我使用Kibana制作的查询:

GET sensor-data/_search
{
  "query": { 
    "bool": {
      "must": [
        {
          "term": {
            "devId.keyword": {
              "value": "a8404143e1877ae1"
            }
          }
        },
        {
          "range": {
            "timestamp": {
              "gte": "2023-06-28T11:21:00.447Z",
              "lte": "2023-06-28T11:22:19.447Z"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "max": {
      "max": {
        "field": "data.EnergyMeterV1.u1.v"
      }
    }
  }
}

这是我从Elasticsearch收到的响应:

{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 3,
    "successful" : 3,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 5.491925,
    "hits" : [
      {
        "_index" : "sensor-data",
        "_type" : "_doc",
        "_id" : "c0C8AYkBNIM9Q_24x62m",
        "_score" : 5.491925,
        "_source" : {
          "$sRef" : "DeviceMetricV1",
          "devId" : "a8404143e1877ae1",
          "timestamp" : "2023-06-28T11:21:31.390Z",
          "data" : {
            "EnergyMeterV1" : {
              "$sRef" : "EnergyMeterV1",
              "u1" : {
                "v" : 234.897,
                "u" : "V"
              }
            }
          }
        }
      }
    ]
  },
  "aggregations" : {
    "max" : {
      "value" : 234.0
    }
  }
}

请注意,在hits部分中,对于我所做的查询,对于一个非常短的时间间隔,只有一个值为234.897的文档。

问题:如何使聚合包括原始值,而不截断为234.897到234.0?

英文:

This is the query I made using Kibana:

GET sensor-data/_search
{
  "query": { 
    "bool": {
      "must": [
        {
          "term": {
            "devId.keyword": {
              "value": "a8404143e1877ae1"
            }
          }
        },
        {
          "range": {
            "timestamp": {
              "gte": "2023-06-28T11:21:00.447Z",
              "lte": "2023-06-28T11:22:19.447Z"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "max": {
      "max": {
        "field": "data.EnergyMeterV1.u1.v"
      }
    }
  }
}

This is the response I get from elasticsearch:

{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 3,
    "successful" : 3,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 5.491925,
    "hits" : [
      {
        "_index" : "sensor-data",
        "_type" : "_doc",
        "_id" : "c0C8AYkBNIM9Q_24x62m",
        "_score" : 5.491925,
        "_source" : {
          "$sRef" : "DeviceMetricV1",
          "devId" : "a8404143e1877ae1",
          "timestamp" : "2023-06-28T11:21:31.390Z",
          "data" : {
            "EnergyMeterV1" : {
              "$sRef" : "EnergyMeterV1",
              "u1" : {
                "v" : 234.897,
                "u" : "V"
              }
            }
          }
        }
      }
    ]
  },
  "aggregations" : {
    "max" : {
      "value" : 234.0
    }
  }
}

Notice in hits section that for the query I made, for a very short time interval, there is only one document with value 234.897.

Question: How can I make aggregations to include the value as it is and not truncated from 234.897 to 234.0?

答案1

得分: 0

你得到的结果可能是因为你的 data.EnergyMeterV1.u1.v 字段的类型是 integerlong。尽管你的源文档包含一个双精度浮点数,但只有整数部分已被索引,聚合只能聚合已被索引的部分,即整数部分。

你有两个修复的选项:

A. 你可以创建一个具有正确映射(即 doublefloat 类型)的新索引,然后将你的旧索引数据重新索引到这个新索引中。

B. 你可以在当前索引映射中添加另一个 doublefloat 字段,然后可以通过更新查询来将 data.EnergyMeterV1.u1.v 字段的值复制到你添加的新字段中。

根据你拥有的数据量,你可能更喜欢其中一个选项,A 是最清晰的选项。

英文:

The result you get is probably due to the fact that your data.EnergyMeterV1.u1.v field is of type integer or long. Even though your source document contains a double, only the integer part has been indexed and the aggregation can only aggregate what's been indexed, i.e. the integer part.

You have two options to fix this:

A. You create a new index with the correct mapping (i.e. double or float type) for the data.EnergyMeterV1.u1.v field and reindex your data from your old index into this new one.

B. You add another double or float field into your current index mapping and then you can update-by-query your index and copy the data.EnergyMeterV1.u1.v field value into the new field you've added.

Depending on the amount of data you have, you might prefer one option over the other, A being the cleanest.

huangapple
  • 本文由 发表于 2023年6月29日 19:45:59
  • 转载请务必保留本文链接:https://go.coder-hub.com/76580730.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定