如何使用cumulative_sum与以前的聚合？ [英] How to use cumulative_sum with a previous aggregation?

问题描述

我想每天绘制一些事件的累积总和。 累积和汇总似乎是要走的路，所以我试图重用文档中给出的例子。

I would like to plot a cumulative sum of some events, per day. The cumulative sum aggregation seems to be the way to go so I tried to reuse the example given in the docs.

第一个聚合工作正常，以下查询

The first aggregation works fine, the following query

{
   "aggs": {
       "vulns_day" : {
           "date_histogram" :{
               "field": "HOST_START_iso",
               "interval": "day"
           }
       }
   }
}

给出回复，如

        (...)
        {
           "key_as_string": "2016-09-08T00:00:00.000Z",
           "key": 1473292800000,
           "doc_count": 76330
        },
        {
           "key_as_string": "2016-09-09T00:00:00.000Z",
           "key": 1473379200000,
           "doc_count": 37712
        },
        (...)

然后我想查询累积总和 doc_count 以上通过

I then wanted to query the cumulative sum of doc_count above via

{
   "aggs": {
       "vulns_day" : {
           "date_histogram" :{
               "field": "HOST_START_iso",
               "interval": "day"
           }
       },
       "aggs": {
           "vulns_cumulated": {
               "cumulative_sum": {
                   "buckets_path": "doc_count"
               }
           }
       }
   }
}

但它给出错误： / p>

but it gives an error:

"reason": {
               "type": "search_parse_exception",
               "reason": "Could not find aggregator type [vulns_cumulated] in [aggs]",

我看到 bucket_path 应该指向要求和的元素，累积聚合的示例创建了一个特定的中间值，但是我没有（ doc_count ）

推荐答案

我找到了解决方案。由于 doc_count 似乎无法使用，所以我尝试为时间参数检索 stats ，并使用其 count value。它的工作：

I found the solution. Since doc_count did not seem to be available, I tried to retrieve stats for the time parameter, and use its count value. It worked:

{
   "size": 0,
   "aggs": {
      "vulns_day": {
         "date_histogram": {
            "field": "HOST_START_iso",
            "interval": "day"
         },
        "aggs": {
          "dates_stats": {
              "stats": {
                  "field": "HOST_START_iso"
              }
          },
         "vulns_cumulated": {
            "cumulative_sum": {
               "buckets_path": "dates_stats.count"
            }
         }
      }
   }
   }
}

这篇关于如何使用cumulative_sum与以前的聚合？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！