我正尝试通过以下网址从日期直方图构面构建器迁移到聚合。
https://www.elastic.co/guide/en/elasticsearch/reference/current/search-facets-migrating-to-aggs.html
我能够将少量查询转换为聚合并获得正确的结果,但是在将以下构面查询转换为聚合查询时抛出异常。
方面:
{
"facets": {
"lapp442.corp.com:timer_micro.99percentile": {
"date_histogram": {
"key_field": "@timestamp",
"value_field": "timer_micro.99percentile",
"interval": "30s"
},
"facet_filter": {
"query": {
"filtered": {
"query": {
"query_string": {
"query": "lapp442.corp.com"
}
},
"filter": {
"bool": {
"must": {
"range": {
"@timestamp": {
"from": "1433145224508",
"to": "now",
"include_lower": true,
"include_upper": true
}
}
}
}
}
}
}
},
"global": true
},
"lapp425.corp.com:timer_micro.99percentile": {
"date_histogram": {
"key_field": "@timestamp",
"value_field": "timer_micro.99percentile",
"interval": "30s"
},
"facet_filter": {
"query": {
"filtered": {
"query": {
"query_string": {
"query": "lapp425.corp.com"
}
},
"filter": {
"bool": {
"must": {
"range": {
"@timestamp": {
"from": "1433145224508",
"to": "now",
"include_lower": true,
"include_upper": true
}
}
}
}
}
}
}
},
"global": true
}
}
}
聚合:
{
"aggregations": {
"lapp442.corp.com:timer_micro.99percentile": {
"date_histogram": {
"field": "@timestamp",
"interval": "30s"
},
"aggregations": {
"metricstats": {
"stats": {
"field": "timer_micro.99percentile"
}
},
"host-filter": {
"filter": {
"query": {
"filtered": {
"query": {
"query_string": {
"query": "lapp442.corp.com"
}
},
"filter": {
"bool": {
"must": {
"range": {
"@timestamp": {
"from": "1433145293851",
"to": "now",
"include_lower": true,
"include_upper": true
}
}
}
}
}
}
}
}
}
}
},
"lapp425.corp.com:timer_micro.99percentile": {
"date_histogram": {
"field": "@timestamp",
"interval": "30s"
},
"aggregations": {
"metricstats": {
"stats": {
"field": "timer_micro.99percentile"
}
},
"host-filter": {
"filter": {
"query": {
"filtered": {
"query": {
"query_string": {
"query": "lapp425.corp.com"
}
},
"filter": {
"bool": {
"must": {
"range": {
"@timestamp": {
"from": "1433145293851",
"to": "now",
"include_lower": true,
"include_upper": true
}
}
}
}
}
}
}
}
}
}
}
}
}
如果在将此构面查询迁移到聚合查询时查询构造错误,请更正我。