Kibana Timelion：子选择或子查询聚合最大总和

Question

假设我在 ElasticSearch 上有以下数据：

@timestamp; userId; currentPoints
August 7th 2017, 00:30:37.319; myUserName; 4
August 7th 2017, 00:43:22.121; myUserName; 10
August 7th 2017, 00:54:29.177; myUserName; 7
August 7th 2017, 01:10:29.352; myUserName; 4
August 7th 2017, 00:32:37.319; myOtherUserName; 12
August 7th 2017, 00:44:22.121; myOtherUserName; 17
August 7th 2017, 00:56:29.177; myOtherUserName; 8
August 7th 2017, 01:18:29.352; myOtherUserName; 11

我想绘制一个日期直方图，它会显示每个用户名每小时所有 max:currentPoints 的总和，它会生成以下数据来绘制：

August 7th 2017, 00; SumOfMaxCurrentPoints -> 27 (max from hour 00h from both users 10 + 17)
August 7th 2017, 00; SumOfMaxCurrentPoints -> 15 (max from hour 01h from both users 4 + 11)

这通常通过子查询来完成，提取用户每小时的 max(currentPoints)，然后对结果求和并每小时汇总。

例如，这可以用 Kibana Timelion 实现吗？我找不到使用文档实现此目的的方法。

谢谢亚历克斯

Answer 1

在处理另一个项目时，我在 Kibana/Elasticsearch 中偶然发现了在不使用 Timelion 的情况下执行此操作的答案。

该功能称为同级管道聚合，在本例中您使用求和桶。您可以将它与任何最近的 Kibana/Elastic 可视化一起使用（我使用的是 5.5 版）。

对于数据集，例如：

@timestamp; userId; currentPoints
August 7th 2017, 00:30:37.319; myUserName; 4
August 7th 2017, 00:43:22.121; myUserName; 10
August 7th 2017, 00:54:29.177; myUserName; 7
August 7th 2017, 01:10:29.352; myUserName; 4
August 7th 2017, 00:32:37.319; myOtherUserName; 12
August 7th 2017, 00:44:22.121; myOtherUserName; 17
August 7th 2017, 00:56:29.177; myOtherUserName; 8
August 7th 2017, 01:18:29.352; myOtherUserName; 11

您想要每个用户 ID 的所有 MAX(currentPoints) 的每小时总和 (currentPoints)，结果是：

August 7th 2017, 00; SumOfMaxCurrentPoints -> 27 (max from hour 00h from both users 10 + 17)
August 7th 2017, 00; SumOfMaxCurrentPoints -> 15 (max from hour 01h from both users 4 + 11)

你可以这样做：

公制

聚合：兄弟管道聚合（求和桶）
桶聚合类型：条款
桶字段: userId
Bucket Size：如果您想要总精度，则高于用户数的舒适值
指标聚合：最大值
指标字段：currentPoints

桶

桶类型：拆分行
桶聚合：日期直方图
直方图字段：@timestamp
直方图间隔：每小时

Kibana Timelion：子选择或子查询聚合最大总和

Kibana Timelion: Subselect or Subquery to aggregate sum of max

elasticsearch

kibana

timelion