以下面的聚合查询为例:
{
"query": {
"match_all": {}
},
"aggs": {
"groupBy": {
"terms": {
"field": "CustomerName"
},
"aggs": {
"points_sum": {
"stats": {
"field": "TransactionAmount"
}
}
}
}
},
"size": 0
}
我有兴趣知道任何CustomerName的平均TransactionAmount(stats.avg)超过某个阈值的所有该客户的购买,只要我将我的平均值高于该阈值的文档编制索引。似乎过滤器设计用于将文档与规则匹配,或多或少,但我找不到使用过滤器匹配基于聚合结果的规则的任何好例子。
这可能吗?过滤器是最好的解决方案吗?还有其他/更好的解决方案吗?提前致谢
答案 0 :(得分:1)
您可以使用Watcher商业产品并定义以下手表:
PUT _watcher/watch/transaction_alert
{
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"search": {
"request": {
"indices": "transactions",
"types": "transaction",
"body": {
"query": {
"match_all": {}
},
"size": 0,
"aggs": {
"groupBy": {
"terms": {
"field": "CustomerName"
},
"aggs": {
"points_sum": {
"stats": {
"field": "TransactionAmount"
}
}
}
}
}
}
}
}
},
"condition": {
"script": {
"inline": "return ctx.payload.aggregations.groupBy.buckets.findAll{ cust -> cust.points_sum.avg >= 200}"
}
},
"actions": {
"send_email": {
"email": {
"to": "<username>@<domainname>",
"subject": "Customer Notification - Transaction > 200",
"body": "The attached customers have a transaction average above $200"
"attachments" : {
"data.yml" : {
"data" : {
"format" : "yaml"
}
}
}
}
}
}
}
<强>更新强>
总结一下:
使用Logstash实现这一目标的另一种更简单,更便宜的方法。即使elasticsearch
输入插件不支持聚合,也可以使用http_poller
输入插件,以便定期向Elasticsearch发送聚合查询。然后使用过滤器,您可以检查是否达到了所需的阈值,最后,如果使用email
输出插件,则通过电子邮件提醒某人。
配置基本上是这样的(请注意,您的上述聚合查询需要进行URL编码并使用source=...
parameter发送到ES)。另请注意,我已根据points_sum.avg
(desc)
input {
http_poller {
urls => {
test1 => 'http://localhost:9200/your-index/_search?source=%7B%22query%22%3A%7B%22match_all%22%3A%7B%7D%7D%2C%22aggs%22%3A%7B%22groupBy%22%3A%7B%22terms%22%3A%7B%22field%22%3A%22CustomerName%22%2C%22order%22%3A%7B%22points_sum.avg%22%3A%22desc%22%7D%7D%2C%22aggs%22%3A%7B%22points_sum%22%3A%7B%22stats%22%3A%7B%22field%22%3A%22TransactionAmount%22%7D%7D%7D%7D%7D%2C%22size%22%3A0%7D'
}
# checking every 10 seconds
interval => 10
codec => "json"
}
}
filter {
split {
field => "[aggregations][groupBy][buckets]"
}
}
output {
if [aggregations][groupBy][buckets][points_sum][avg] > 200 {
email {
to => "<username>@<domainname>"
subject => "Customer Notification - Transaction > 200",
body => "The customer %{[aggregations][groupBy][buckets][key]} has a transaction average above $200"
}
}
}
同意,这是一个非常简单的实现,但它应该工作,你可以在它上面使它变得更聪明,使用Logstash和你的想象力限制是天空; - )
更新2
还可以利用另一个node.js工具调用elasticwatch来执行此操作。