如何从Elasticsearch索引中的两个字段派生一个字段？ [英] How to derive a field from two fields in an Elasticsearch index?

问题描述

我有一个包含以下字段的索引：

I have an index with fields:

• room_name


• 开始日期（开始时间是


• 结束日期（已使用结束时间的房间）

我正在创建curl命令

I am creating a curl command wherein I can get the time when a room was used.

有可能吗？

这里是当前的卷曲命令：

Here is current curl command:

curl -XGET "https://localhost:9200/testindex/_search?pretty" -H 'Content-Type: application/json' -d'
{
    "aggs": {
        "room_bucket":{
            "terms": {
                "field": "room_name.keyword",
            },
            "aggs":{
                "hour_bucket": {
                    "terms": {
                        "script": {
                            "inline": "def l = doc[\"start_date \"].value;\nif ( l <= 20 && l >= 9 ) {\n  return l;\n}",
                            "lang": "painless"
                        },
                        "order": {
                            "_key": "asc"
                     },
                     "value_type": "long"
                    }
                }
            }
        }
    }
}'

此处结果是：

{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 3,
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "testindex",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 1.0,
        "_source" : {
          "log_version" : 1,
          "start_date" : 10,
          "end_date" : 11,
      "room_name" : "room_Y"
        }
      },
      {
        "_index" : "testindex",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 1.0,
        "_source" : {
          "log_version" : 1,
          "start_date" : 11,
          "end_date" : 13,
          "room_name" : "room_V"
        }
      },
      {
        "_index" : "testindex",
        "_type" : "_doc",
        "_id" : "3",
        "_score" : 1.0,
        "_source" : {
          "log_version" : 1,
          "start_date" : 10,
          "end_date" : 12,
          "room_name" : "room_Y"
        }
      }
    ]
  },
  "aggregations" : {
    "room_bucket" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "room_V",
          "doc_count" : 1,
          "hour_bucket" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : 11,
                "doc_count" : 1
              }
            ]
          }
        },
        {
          "key" : "room_Y",
          "doc_count" : 1,
          "hour_bucket" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : 10,
                "doc_count" : 1
              }
            ]
          }
        }
      ]
    }
  }
}

但是我在 聚合中的预期结果如下：

But my expected result in the "aggregations" is the following:

"aggregations" : {
    "room_bucket" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "room_V",
          "doc_count" : 1,
          "hour_bucket" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : 11,
                "doc_count" : 1
              },
              {
                "key" : 12,
                "doc_count" : 1
              },
              {
                "key" : 13,
                "doc_count" : 1
              }
            ]
          }
        },
        {
          "key" : "room_Y",
          "doc_count" : 1,
          "hour_bucket" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : 10,
                "doc_count" : 2
              },
              {
                "key" : 11,
                "doc_count" : 2
              },
              {
                "key" : 12,
                "doc_count" : 1
              }
            ]
          }
        }
      ]
    }
  }

当前结果，它只读取开始日期。

但是，在预期输出中， Room_V 应该具有 key = 11 ， key = 12 ， key = 13 （ doc_count 每个应该为1键），因为根据开始日期和结束日期，房间的使用时间为11月13日。

However, in the expected output, Room_V should have "key" = 11, "key" = 12, "key" = 13 (doc_count should be 1 for each key) because based on start_date and end_date, the room was used from 11 - 13.

推荐答案

您可以通过以下方式实现所需的功能利用 LongStream 并创建时间间隔中所有小时的数组，如下所示：

You can achieve what you want by leveraging LongStream and creating an array of all the hours in the interval, like this:

curl -XGET "https://localhost:9200/testindex/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "aggs": {
    "room_bucket": {
      "terms": {
        "field": "room_name.keyword"
      },
      "aggs": {
        "hour_bucket": {
          "terms": {
            "script": {
              "inline": """
              return LongStream.rangeClosed(doc.start_date.value, doc.end_date.value).toArray();

""",
              "lang": "painless"
            },
            "order": {
              "_key": "asc"
            },
            "value_type": "long"
          }
        }
      }
    }
  }
}'

这篇关于如何从Elasticsearch索引中的两个字段派生一个字段？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！