使用查询字符串从日期直方图构面构建器迁移到聚合

时间:2015-06-01 10:13:24

标签: elasticsearch aggregation facet

我正尝试通过以下网址从日期直方图构面构建器迁移到聚合。

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-facets-migrating-to-aggs.html

我能够将少量查询转换为聚合并获得正确的结果,但是在将以下构面查询转换为聚合查询时抛出异常。

方面:

{
    "facets": {
        "lapp442.corp.com:timer_micro.99percentile": {
            "date_histogram": {
                "key_field": "@timestamp",
                "value_field": "timer_micro.99percentile",
                "interval": "30s"
            },
            "facet_filter": {
                "query": {
                    "filtered": {
                        "query": {
                            "query_string": {
                                "query": "lapp442.corp.com"
                            }
                        },
                        "filter": {
                            "bool": {
                                "must": {
                                    "range": {
                                        "@timestamp": {
                                            "from": "1433145224508",
                                            "to": "now",
                                            "include_lower": true,
                                            "include_upper": true
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            },
            "global": true
        },
        "lapp425.corp.com:timer_micro.99percentile": {
            "date_histogram": {
                "key_field": "@timestamp",
                "value_field": "timer_micro.99percentile",
                "interval": "30s"
            },
            "facet_filter": {
                "query": {
                    "filtered": {
                        "query": {
                            "query_string": {
                                "query": "lapp425.corp.com"
                            }
                        },
                        "filter": {
                            "bool": {
                                "must": {
                                    "range": {
                                        "@timestamp": {
                                            "from": "1433145224508",
                                            "to": "now",
                                            "include_lower": true,
                                            "include_upper": true
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            },
            "global": true
        }
    }
}

聚合:

{
    "aggregations": {
        "lapp442.corp.com:timer_micro.99percentile": {
            "date_histogram": {
                "field": "@timestamp",
                "interval": "30s"
            },
            "aggregations": {
                "metricstats": {
                    "stats": {
                        "field": "timer_micro.99percentile"
                    }
                },
                "host-filter": {
                    "filter": {
                        "query": {
                            "filtered": {
                                "query": {
                                    "query_string": {
                                        "query": "lapp442.corp.com"
                                    }
                                },
                                "filter": {
                                    "bool": {
                                        "must": {
                                            "range": {
                                                "@timestamp": {
                                                    "from": "1433145293851",
                                                    "to": "now",
                                                    "include_lower": true,
                                                    "include_upper": true
                                                }
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        },
        "lapp425.corp.com:timer_micro.99percentile": {
            "date_histogram": {
                "field": "@timestamp",
                "interval": "30s"
            },
            "aggregations": {
                "metricstats": {
                    "stats": {
                        "field": "timer_micro.99percentile"
                    }
                },
                "host-filter": {
                    "filter": {
                        "query": {
                            "filtered": {
                                "query": {
                                    "query_string": {
                                        "query": "lapp425.corp.com"
                                    }
                                },
                                "filter": {
                                    "bool": {
                                        "must": {
                                            "range": {
                                                "@timestamp": {
                                                    "from": "1433145293851",
                                                    "to": "now",
                                                    "include_lower": true,
                                                    "include_upper": true
                                                }
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}

如果在将此构面查询迁移到聚合查询时查询构造错误,请更正我。

0 个答案:

没有答案