Elasticsearch 在不同时间范围内多次聚合

发布于 2025-01-11 16:31:58 字数 477 浏览 0 评论 0原文

我试图按查询中给出的时间范围的每一半聚合一个字段。例如，以下是查询：

{
"query": {
  "simple_query_string": {
    "query": "+sitetype:(redacted) +sort_date:[now-2h TO now]"
    }
  }
}

...我想聚合从 now-2h 到 now-1h 的术语“product1.keyword”，并聚合从 now-1h 到现在的同一术语“product1.keyword”，就像:

"terms": {
  "field": "product1",
  "size": 10,
}

^ 在 now-2h 到 now-1h 内汇总产品 1 的前 10 个结果，并汇总现在至现在 1 小时内产品 1 的前 10 个结果。

澄清：product1 不是与日期或时间相关的字段。它就像一种汽车、电话等。

原文

I'm trying to aggregate a field by each half of the time-range given in the query. For example, here's the query:

{
"query": {
  "simple_query_string": {
    "query": "+sitetype:(redacted) +sort_date:[now-2h TO now]"
    }
  }
}

...and I want to aggregate on term "product1.keyword" from now-2h to now-1h and aggregate on the same term "product1.keyword" from now-1h to now, so like:

"terms": {
  "field": "product1",
  "size": 10,
}

^ aggregate the top 10 results on product1 in now-2h TO now-1h,
and aggregate the top 10 results on product1 in now-1h TO now.

Clarification: product1 is not a date or time-related field. It would be like a type of car, phone, etc.

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

苍风燃霜 2025-01-18 16:31:58

如果你想在查询中使用now，你必须将product1字段设置为date类型，那么你可以尝试如下：

GET index1/_search
{
  "size": 0,
  "aggs": {
    "dataAgg": {
      "date_range": {
        "field": "product1",
        "ranges": [
          {
            "from": "now-2h",
            "to": "now-1h"
          },
          {
            "from": "now-1h",
            "to": "now"
          }
        ]
      },
      "aggs": {
        "top10": {
          "top_hits": {
            "size": 10
          }
        }
      }
    }
  }
}

如果你不能改变product1的类型，你可以尝试 rang agg，但是必须显式地写出时间，而不是使用now

if you want use now in your query，you must make product1 field as date type，then you can try as below：

GET index1/_search
{
  "size": 0,
  "aggs": {
    "dataAgg": {
      "date_range": {
        "field": "product1",
        "ranges": [
          {
            "from": "now-2h",
            "to": "now-1h"
          },
          {
            "from": "now-1h",
            "to": "now"
          }
        ]
      },
      "aggs": {
        "top10": {
          "top_hits": {
            "size": 10
          }
        }
      }
    }
  }
}

and if you can't change product1's type ，you can try rang agg，but you must write the time explicitly instead of using now

回复收藏 0 原文

~没有更多了~