带时间戳的 Elasticsearch 术语聚合和范围

Question

我正在尝试计算按用户代理分组的日志数量。

这就是我的。

GET /myindex/_search
{
  "size": 30,
  "stored_fields": ["req.headers.user-agent.keyword"],
  "aggs": {
    "group_by_userAgent": {
      "terms": {
        "field": "req.headers.user-agent.keyword"
      }
    }
  }
}

我想添加 "Query last 15 mins" 功能。我尝试添加 'range' 查询，但最终得到了以下查询，但该查询不起作用。

GET /myindex/_search
{
  "size": 30,
  "stored_fields": ["req.headers.user-agent.keyword"],


  "aggs": {

    "group_by_userAgent": {
      "terms": {
        "field": "req.headers.user-agent.keyword"
      },
      "range": {
        "timestamp": {
          "gt": "now-15m"
        }
      }
    }
  }
}

如何使用 "now-x15min" 语法查询范围内的术语聚合？

Answer 1

您首先需要一个过滤器聚合来应用范围查询，然后添加一个术语子聚合。

参见：https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filter-aggregation.html

Answer 2

range 应该进入查询部分，而不是聚合。时间范围很好

我认为您要查找的是前 30 个用户代理存储桶中的文档数量，即产生最多日志的前 30 个用户代理

GET /myindex/_search
{
  "size": 0,
  "query": {
    "range": {
      "@timestamp": {
        "gt": "now-15m"
      }
    }
  },
  "aggs": {
    "group_by_userAgent": {
      "terms": {
        "field": "req.headers.user-agent.keyword",
        "size": 30
      }
    }
  }
}

Answer 3

您可以通过两种方式来实现用户代理的聚合结果。

POST phrase_index/_search
{
  "aggs": {
    "date_range_filtered_agg": {
      "filter": {
        "range": {
          "timestamp": {
            "gte": "now-15m/m"
          }
        }
      },
      "aggs": {
        "group_by_userAgent": {
          "terms": {
            "field": "req.headers.user-agent.keyword",
            "size": 10
          }
        }
      }
    }
  },
  "size": 30,
  "stored_fields": ["req.headers.user-agent.keyword"]
}


POST phrase_index/_search
{
  "query": {
    "range": {
      "timestamp": {
        "gte": "now-15m/m"
      }
    }
  },
  "aggs": {
    "group_by_userAgent": {
      "terms": {
        "field": "req.headers.user-agent.keyword",
        "size": 10
      }
    }
  },
  "size": 30,
  "stored_fields": ["req.headers.user-agent.keyword"]
}

带时间戳的 Elasticsearch 术语聚合和范围

Elasticsearch term aggregation and range with timestamp

range

aggregation

elasticsearch