elasticsearch 如何编写弹性查询以查找提前一天的连续间隔

9udxz4iz  于 2022-12-17  发布在  ElasticSearch
关注(0)|答案(1)|浏览(120)

我找不到如何查询弹性来查找多个间隔的数据,以一天为增量增加到月底。
例如,我想查看1月份的7天间隔,1-7、2-8、3-9、4-10等。但对于给定的查询,我得到的结果如下:1-7、8-15、16-23等。
有人知道这在弹性中是否可行,或者如何用我连续几天写的结果编写查询吗?
下面是我的尝试:

{
    "size": 0,
    "query": {
        "bool": {,
            "filter": [
                {
                    "range": {
                        "associated_datetime": {
                            "gte": "14/12/2021 19:31:56",
                            "lte": "14/12/2022 19:31:56",
                            "format": "dd/MM/yyyy HH:mm:ss"
                        }
                    }
                }
            ]
        }
    },
    "aggs": {
        "incident": {
            "date_histogram": {
                "field": "associated_datetime",
                "calendar_interval": "week"
            },
            "aggs": {
                "associated_to.id": {
                    "terms": {
                        "size": 10000,
                        "field": "associated_to.id"
                    }
                }
            }
        }
    }
}

上述查询的输出如下所示(聚合对象):

"aggregations": {
        "incident": {
            "buckets": [
                {
                    "key_as_string": "2022-01-03T00:00:00.000Z",
                    "key": 1641168000000,
                    "doc_count": 2,
                    "associated_to.id": {
                        "doc_count_error_upper_bound": 0,
                        "sum_other_doc_count": 0,
                        "buckets": [
                            {
                                "key": 4,
                                "doc_count": 2
                            }
                        ]
                    }
                },
                {
                    "key_as_string": "2022-01-10T00:00:00.000Z",
                    "key": 1641772800000,
                    "doc_count": 1,
                    "associated_to.id": {
                        "doc_count_error_upper_bound": 0,
                        "sum_other_doc_count": 0,
                        "buckets": [
                            {
                                "key": 2,
                                "doc_count": 1
                            }
                        ]
                    }
                },
                {
                    "key_as_string": "2022-01-17T00:00:00.000Z",
                    "key": 1642377600000,
                    "doc_count": 1,
                    "associated_to.id": {
                        "doc_count_error_upper_bound": 0,
                        "sum_other_doc_count": 0,
                        "buckets": [
                            {
                                "key": 2,
                                "doc_count": 1
                            }
                        ]
                    }
                },
                {
                    "key_as_string": "2022-03-07T00:00:00.000Z",
                    "key": 1646611200000,
                    "doc_count": 1,
                    "associated_to.id": {
                        "doc_count_error_upper_bound": 0,
                        "sum_other_doc_count": 0,
                        "buckets": [
                            {
                                "key": 4,
                                "doc_count": 1
                            }
                        ]
                    }
                },
                {
                    "key_as_string": "2022-03-21T00:00:00.000Z",
                    "key": 1647820800000,
                    "doc_count": 7,
                    "associated_to.id": {
                        "doc_count_error_upper_bound": 0,
                        "sum_other_doc_count": 0,
                        "buckets": [
                            {
                                "key": 37,
                                "doc_count": 2
                            },
                            {
                                "key": 38,
                                "doc_count": 2
                            },
                            {
                                "key": 39,
                                "doc_count": 2
                            },
                            {
                                "key": 40,
                                "doc_count": 1
                            }
                        ]
                    }
                },
                {
                    "key_as_string": "2022-05-16T00:00:00.000Z",
                    "key": 1652659200000,
                    "doc_count": 1,
                    "associated_to.id": {
                        "doc_count_error_upper_bound": 0,
                        "sum_other_doc_count": 0,
                        "buckets": [
                            {
                                "key": 4,
                                "doc_count": 1
                            }
                        ]
                    }
                },
                {
                    "key_as_string": "2022-11-14T00:00:00.000Z",
                    "key": 1668384000000,
                    "doc_count": 3,
                    "associated_to.id": {
                        "doc_count_error_upper_bound": 0,
                        "sum_other_doc_count": 0,
                        "buckets": [
                            {
                                "key": 2,
                                "doc_count": 2
                            },
                            {
                                "key": 37,
                                "doc_count": 1
                            },
                            {
                                "key": 38,
                                "doc_count": 1
                            },
                            {
                                "key": 39,
                                "doc_count": 1
                            },
                            {
                                "key": 40,
                                "doc_count": 1
                            },
                            {
                                "key": 41,
                                "doc_count": 1
                            },
                            {
                                "key": 42,
                                "doc_count": 1
                            }
                        ]
                    }
                }
            ]
        }
    }
w8biq8rn

w8biq8rn1#

一种方法是使用date_range aggregation(注意:范围的to日期不包括在内):

{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "associated_datetime": {
              "gte": "14/12/2021 19:31:56",
              "lte": "14/12/2022 19:31:56",
              "format": "dd/MM/yyyy HH:mm:ss"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "incident": {
      "date_range": {
        "field": "associated_datetime",
        "ranges": [
          {
            "from": "2022-01-01",
            "to": "2022-01-08"
          },
          {
            "from": "2022-01-02",
            "to": "2022-01-09"
          },
          {
            "from": "2022-01-03",
            "to": "2022-01-10"
          },
          ...
        ]
      },
      "aggs": {
        "associated_to.id": {
          "terms": {
            "size": 10000,
            "field": "associated_to.id"
          }
        }
      }
    }
  }
}

相关问题