Kibana 查询嵌套对象 returns 估计价格为什么？
Kibana query on NESTED object returns estimated price why?
在 Kibana 可视化中，我构建了一个条形图，用于聚合每个标签桶的订单（例如：USD/CAD）。然后我显示其中每个订单的每个桶的订单价格总和。
我的图表可视化returns 一个错误的价格，似乎正在逼近
这是我的图形查询请求调试
{
"size": 0,
"_source": {
"excludes": []
},
"aggs": {
"3": {
"terms": {
"field": "label.keyword",
"size": 2,
"order": {
"_term": "desc"
}
},
"aggs": {
"2": {
"terms": {
"field": "orders.id",
"size": 40,
"order": {
"1": "desc"
}
},
"aggs": {
"1": {
"sum": {
"field": "orders.price"
}
}
}
}
}
}
},
"stored_fields": [
"*"
],
"script_fields": {},
"docvalue_fields": [],
"query": {
"bool": {
"must": [
{
"match_all": {}
}
],
"filter": [],
"should": [],
"must_not": []
}
}
}
这是响应，确认 orders.price 值正在被近似
{
"took": 9,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 124,
"max_score": 0,
"hits": []
},
"aggregations": {
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 122,
"buckets": [
{
"2": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"1": {
"value": 0.003690590019687079
},
"key": 213481,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213482,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213483,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213484,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213485,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213486,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213487,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213488,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213489,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213490,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213491,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213492,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213493,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213494,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213495,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213496,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213497,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213498,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213499,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213500,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213501,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213502,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213503,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213504,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213505,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213506,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213507,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213508,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213509,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213510,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213511,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213512,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213513,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213514,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213515,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213516,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213517,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213518,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213519,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213520,
"doc_count": 1
}
]
},
"key": "IOST/ETH",
"doc_count": 1
},
{
"2": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"1": {
"value": 0.0003004000000146334
},
"key": 213321,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213322,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213323,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213324,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213325,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213326,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213327,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213328,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213329,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213330,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213331,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213332,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213333,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213334,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213335,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213336,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213337,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213338,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213339,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213340,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213341,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213342,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213343,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213344,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213345,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213346,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213347,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213348,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213349,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213350,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213351,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213352,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213353,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213354,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213355,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213356,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213357,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213358,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213359,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213360,
"doc_count": 1
}
]
},
"key": "IOST/BTC",
"doc_count": 1
}
]
}
},
"status": 200
并且发现选项卡确认我的数据在那里并且应该从 order.price
中检索正确的价格
更奇怪的是，当我展平我的数据并停止使用嵌套订单数组时，同一个图表仍然有效。构建图形时我做错了什么吗？我需要解决这个问题，因为我的源数据来自那个结构，每个标签都有一个嵌套的订单数组
为了获得准确的结果，订单字段必须映射为嵌套类型。
"mappings": {
"orderbook": {
"properties": {
"exchange": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"id": {
"type": "long"
},
"label": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"length": {
"type": "long"
},
"orders": {
"type": "nested",
"properties": {
"id": {
"type": "long"
},
"label": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"price": {
"type": "float"
}
}
},
"timestamp": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
在 Kibana 中你可以像这样使用 vega
{
"$schema": "https://vega.github.io/schema/vega-lite/v2.json",
"title": "Order Totals vs Order Ids",
"data": {
"url": {
"index": "orderbookindex",
"body": {
"size": 0,
"aggs": {
"Orders": {
"nested": {"path": "orders"},
"aggs": {
"Order_Ids": {
"terms": {"field": "orders.id"},
"aggs": {
"Order_Totals": {
"sum": {"field": "orders.price"}
}
}
}
}
}
}
}
},
"format": {
"property": "aggregations.Orders.Order_Ids.buckets"
}
},
"mark": "bar",
"encoding": {
"x": {
"bin": false,
"field": "key",
"type": "Nominal",
"axis": {"title": "Order Ids"}
},
"y": {
"field": "Order_Totals.value",
"type": "quantitative",
"axis": {"title": "Order Totals"}
}
}
}
我还没有尝试过其他层的分组，但你需要这样的东西 https://bl.ocks.org/domoritz/f5abc519dd990bfcbc3f20f634658364
Kibana 中还有一个插件可以处理嵌套聚合，你可以试试
https://github.com/ppadovani/KibanaNestedSupportPlugin
----------------解输出---------------------------- -----
来自 @sramalingam24 Vega 代码的 Guid 输出
在 Kibana 可视化中，我构建了一个条形图，用于聚合每个标签桶的订单（例如：USD/CAD）。然后我显示其中每个订单的每个桶的订单价格总和。
我的图表可视化returns 一个错误的价格，似乎正在逼近
这是我的图形查询请求调试
{
"size": 0,
"_source": {
"excludes": []
},
"aggs": {
"3": {
"terms": {
"field": "label.keyword",
"size": 2,
"order": {
"_term": "desc"
}
},
"aggs": {
"2": {
"terms": {
"field": "orders.id",
"size": 40,
"order": {
"1": "desc"
}
},
"aggs": {
"1": {
"sum": {
"field": "orders.price"
}
}
}
}
}
}
},
"stored_fields": [
"*"
],
"script_fields": {},
"docvalue_fields": [],
"query": {
"bool": {
"must": [
{
"match_all": {}
}
],
"filter": [],
"should": [],
"must_not": []
}
}
}
这是响应，确认 orders.price 值正在被近似
{
"took": 9,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 124,
"max_score": 0,
"hits": []
},
"aggregations": {
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 122,
"buckets": [
{
"2": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"1": {
"value": 0.003690590019687079
},
"key": 213481,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213482,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213483,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213484,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213485,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213486,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213487,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213488,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213489,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213490,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213491,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213492,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213493,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213494,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213495,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213496,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213497,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213498,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213499,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213500,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213501,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213502,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213503,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213504,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213505,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213506,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213507,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213508,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213509,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213510,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213511,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213512,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213513,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213514,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213515,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213516,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213517,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213518,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213519,
"doc_count": 1
},
{
"1": {
"value": 0.003690590019687079
},
"key": 213520,
"doc_count": 1
}
]
},
"key": "IOST/ETH",
"doc_count": 1
},
{
"2": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"1": {
"value": 0.0003004000000146334
},
"key": 213321,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213322,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213323,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213324,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213325,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213326,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213327,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213328,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213329,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213330,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213331,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213332,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213333,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213334,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213335,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213336,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213337,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213338,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213339,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213340,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213341,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213342,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213343,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213344,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213345,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213346,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213347,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213348,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213349,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213350,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213351,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213352,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213353,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213354,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213355,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213356,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213357,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213358,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213359,
"doc_count": 1
},
{
"1": {
"value": 0.0003004000000146334
},
"key": 213360,
"doc_count": 1
}
]
},
"key": "IOST/BTC",
"doc_count": 1
}
]
}
},
"status": 200
并且发现选项卡确认我的数据在那里并且应该从 order.price
更奇怪的是，当我展平我的数据并停止使用嵌套订单数组时，同一个图表仍然有效。构建图形时我做错了什么吗？我需要解决这个问题，因为我的源数据来自那个结构，每个标签都有一个嵌套的订单数组
为了获得准确的结果，订单字段必须映射为嵌套类型。
"mappings": {
"orderbook": {
"properties": {
"exchange": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"id": {
"type": "long"
},
"label": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"length": {
"type": "long"
},
"orders": {
"type": "nested",
"properties": {
"id": {
"type": "long"
},
"label": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"price": {
"type": "float"
}
}
},
"timestamp": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
在 Kibana 中你可以像这样使用 vega
{
"$schema": "https://vega.github.io/schema/vega-lite/v2.json",
"title": "Order Totals vs Order Ids",
"data": {
"url": {
"index": "orderbookindex",
"body": {
"size": 0,
"aggs": {
"Orders": {
"nested": {"path": "orders"},
"aggs": {
"Order_Ids": {
"terms": {"field": "orders.id"},
"aggs": {
"Order_Totals": {
"sum": {"field": "orders.price"}
}
}
}
}
}
}
}
},
"format": {
"property": "aggregations.Orders.Order_Ids.buckets"
}
},
"mark": "bar",
"encoding": {
"x": {
"bin": false,
"field": "key",
"type": "Nominal",
"axis": {"title": "Order Ids"}
},
"y": {
"field": "Order_Totals.value",
"type": "quantitative",
"axis": {"title": "Order Totals"}
}
}
}
我还没有尝试过其他层的分组，但你需要这样的东西 https://bl.ocks.org/domoritz/f5abc519dd990bfcbc3f20f634658364
Kibana 中还有一个插件可以处理嵌套聚合，你可以试试 https://github.com/ppadovani/KibanaNestedSupportPlugin
----------------解输出---------------------------- -----
来自 @sramalingam24 Vega 代码的 Guid 输出