多个过滤器和弹性搜索中的聚合 [英] Multiple filters and an aggregate in elasticsearch
问题描述
如何在弹性搜索中使用与聚合有关的过滤器?
How can I use a filter in connection with an aggregate in elasticsearch?
官方文档仅提供了过滤器以及聚合,而没有查询的正式描述dsl - 比较它 postgres文档。
The official documentation gives only trivial examples for filter and for aggregations and no formal description of the query dsl - compare it e.g. with postgres documentation.
通过尝试我找到以下查询,这是通过elasticsearch(没有解析错误)接受,但忽略给定的过滤器:
Through trying out I found following query, which is accepted by elasticsearch (no parsing errors), but ignores the given filters:
{
"filter": {
"and": [
{
"term": {
"_type": "logs"
}
},
{
"term": {
"dc": "eu-west-12"
}
},
{
"term": {
"status": "204"
}
},
{
"range": {
"@timestamp": {
"from": 1398169707,
"to": 1400761707
}
}
}
]
},
"size": 0,
"aggs": {
"time_histo": {
"date_histogram": {
"field": "@timestamp",
"interval": "1h"
},
"aggs": {
"name": {
"percentiles": {
"field": "upstream_response_time",
"percents": [
98.0
]
}
}
}
}
}
}
$有些人建议使用查询
而不是过滤器
。但官方文档通常建议相反的进行筛选值。 查询
的另一个问题是:过滤器提供 和
,查询
不。
Some people suggest using query
instead of filter
. But the official documentation generally recommends the opposite for filtering on exact values. Another issue with query
: while filters offer an and
, query
does not.
有人可以指出文档,博客或书籍,其中描述了写入非平凡查询:至少一个聚合加上多个过滤器。
Can somebody point me to documentation, a blog or a book, which describe writing non-trivial queries: at least an aggregate plus multiple filters.
推荐答案
我最后使用了一个过滤器聚合 - 未过滤的查询。所以现在我有3个嵌套的aggs元素。
I ended up using a filter aggregation - not filtered query. So now I have 3 nested aggs elements.
我还使用 bool
过滤器而不是和
由@ alex-brasetvik推荐,因为 http://www.elasticsearch.org/blog/all-about-elasticsearch-filter-bitsets/
I also use bool
filter instead of and
as recomended by @alex-brasetvik because of http://www.elasticsearch.org/blog/all-about-elasticsearch-filter-bitsets/
我的最终实现:
{
"aggs": {
"filtered": {
"filter": {
"bool": {
"must": [
{
"term": {
"_type": "logs"
}
},
{
"term": {
"dc": "eu-west-12"
}
},
{
"term": {
"status": "204"
}
},
{
"range": {
"@timestamp": {
"from": 1398176502000,
"to": 1400768502000
}
}
}
]
}
},
"aggs": {
"time_histo": {
"date_histogram": {
"field": "@timestamp",
"interval": "1h"
},
"aggs": {
"name": {
"percentiles": {
"field": "upstream_response_time",
"percents": [
98.0
]
}
}
}
}
}
}
},
"size": 0
}
这篇关于多个过滤器和弹性搜索中的聚合的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!