Question

我的地图模型：

// TypeLog：错误，信息，警告

{
   "onef-sora": {
      "mappings": {
         "Log": {
            "properties": {

               "application": {
                  "type": "string",
                  "index": "not_analyzed"
               }
               "typeLog": {
                  "type": "string"
               }
            }
         }
      }
   }
}

我的查询：

{
  "size": 0,
  "aggs": {
    "application": {
      "terms": {
        "field": "application",
        "order" : { "_count" : "desc"},
        "size": 5
      },
      "aggs": {
        "typelogs": {
          "terms": {
            "field": "typeLog",
            "order" : { "_term" : "asc"}
          }
        }
      }
    }
  }
}

我想要获得前5名应用程序的大多数错误，但是术语聚合顺序支持三个键：_count，_term，_key。如何在查询中按类型log doc_count订购。谢谢!!!

我想要的结果：

 {
   "took": 3,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 10000,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "application": {
         "doc_count_error_upper_bound": 0,
         "sum_other_doc_count": 5000,
         "buckets": [
            {
               "key": "OneF0",
               "doc_count": 1000,
               "typelogs": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                     {
                        "key": "error",
                        "doc_count": 334
                     },
                     {
                        "key": "info",
                        "doc_count": 333
                     },
                     {
                        "key": "warn",
                        "doc_count": 333
                     }
                  ]
               }
            },
            {
               "key": "OneF1",
               "doc_count": 1000,
               "typelogs": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                     {
                        "key": "error",
                        "doc_count": 333
                     },
                     {
                        "key": "info",
                        "doc_count": 334
                     },
                     {
                        "key": "warn",
                        "doc_count": 333
                     }
                  ]
               }
            },
            {
               "key": "OneF2",
               "doc_count": 1000,
               "typelogs": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                     {
                        "key": "error",
                        "doc_count": 332
                     },
                     {
                        "key": "info",
                        "doc_count": 333
                     },
                     {
                        "key": "warn",
                        "doc_count": 334
                     }
                  ]
               }
            }

         ]
      }
   }
}

Answer 1

当您获得大多数错误的前5个应用程序时，您可以过滤以仅在查询中保留错误日志（您可以使用过滤器）。那么你只需要通过递减计数来命令你进行子项聚合

{
  "size": 0,
  "query": {
    "term": {
      "typeLog": "Error"
    }
  },
  "aggs": {
    "application": {
      "terms": {
        "field": "application",
        "order": {
          "_count": "desc"
        },
        "size": 5
      },
      "aggs": {
        "typelogs": {
          "terms": {
            "field": "typeLog",
            "order": {
              "_count": "desc"
            }
          }
        }
      }
    }
  }
}

要保留所有类型日志，您可能需要以其他方式执行查询

{
  "size": 0,
  "aggs": {
    "typelogs": {
      "terms": {
        "field": "typeLog",
        "order": {
          "_count": "asc"
        }
      },
      "aggs": {
        "application": {
          "terms": {
            "field": "application",
            "order": {
              "_count": "desc"
            },
            "size": 5
          }
        }
      }
    }
  }
}

您将拥有3个第一级存储桶，按日志类型排在前5位应用程序

ElasticSearch聚合按子顺序按字段顺序分组

1 个答案: