日期聚合 - elasticsearch

Question

我最近开始研究elasticsearch，我在日期聚合方面遇到了一个问题。

映射：

{
  "posts": {
    "mappings": {
        "facebook": {
            "properties": {
                "post_created_time": {
                    "type": "date"
                },
                "post_description": {
                    "type": "text"
                },
                "post_image": {
                    "type": "text"
                }
            }
        }
    }
  }
}

来源：

"hits": [
        {
            "_index": "posts",
            "_type": "facebook",
            "_id": "1027753751227740806",
            "_score": 1,
            "_source": {
                "post_created_time": 1436737816,
                "post_description": "captain's log: sailed a sea of booze after sundown with a new crew. bonds cemented. four more days of r&r before the next voyage. july the 5th, 2015 #captainslog #litely",
                "post_image": "https://scontent.cdninstagram.com/t51.2885-15/s640x640/sh0.08/e35/11419297_845398318885282_1471458983_n.jpg?ig_cache_key=MTAyNzc1Mzc1MTIyNzc0MDgwNg%3D%3D.2"
            }
        },
        {
            "_index": "posts",
            "_type": "facebook",
            "_id": "1030858912926085173",
            "_score": 1,
            "_source": {
                "post_created_time": 1436218427,
                "post_description": "wanna go for a ride? #?",
                "post_image": "https://scontent.cdninstagram.com/t51.2885-15/s640x640/sh0.08/e35/1739201_510171422480872_883567488_n.jpg?ig_cache_key=MTAzMDg1ODkxMjkyNjA4NTE3Mw%3D%3D.2"
            }
        }
]

我已经尝试过查询：

{  
 "size":0,
 "aggs":{  
     "metrics_by_day":{  
     "date_histogram":{  
        "field":"post_created_time",
        "interval":"day"
     }
   }
 }
}

以上查询的输出：

"aggregations": {
    "metrics_by_day": {
        "buckets": [
            {
                "key_as_string": "1970-01-17",
                "key": 1382400000,
                "doc_count": 2
            }
        ]
    }
}

预期输出为：

"aggregations": {
    "metrics_by_day": {
        "buckets": [
            {
                "key_as_string": "2015-07-12",
                "doc_count": 1
            },
            {
                "key_as_string": "2015-07-06",
                "doc_count": 1
            }
        ]
    }
}

任何建议都将不胜感激

Answer 1

您的地图和汇总中的日期格式存在问题。您的日期类型格式为c:/Rtools/mingw_64/bin/g++ -I"C:/PROGRA~1/R/R-34~1.0/include" -DNDEBUG -I"C:/Users/xy/Documents/R/win-library/3.4/Rcpp/include" -I"c:/Users/Yesim/Desktop/julivierrcpp" -I"d:/Compiler/gcc-4.9.3/local330/include" -std=c++14 -O2 -Wall -mtune=core2 -c main.cpp -o main.o main.cpp: In function 'Rcpp::List read(std::string, std::string)': main.cpp:48:39: error: no matching function for call to 'as(std::string&)' string suchen = Rcpp::as<string>(arg); ^ main.cpp:48:39: note: candidate is: In file included from C:/Users/Yesim/Documents/R/win- library/3.4/Rcpp/include/RcppCommon.h:160:0, from C:/Users/Yesim/Documents/R/win- library/3.4/Rcpp/include/Rcpp.h:27, from main.cpp:8: C:/Users/xy/Documents/R/win-library/3.4/Rcpp/include/Rcpp/as.h:143:29: note: template<class T> T Rcpp::as(SEXP) template <typename T> T as(SEXP x) { ^ C:/Users/xy/Documents/R/win-library/3.4/Rcpp/include/Rcpp/as.h:143:29: note: template argument deduction/substitution failed: main.cpp:48:39: note: cannot convert 'arg' (type 'std::string {aka std::basic_string<char>}') to type 'SEXP' string search= Rcpp::as<string>(arg); ^ make: *** [main.o] Error 1 （https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html），您必须指定DateHistogramm聚合的日期格式"format" : "epoch_second"（https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-datehistogram-aggregation.html）

以下是更正的映射：

"format" : "yyyy-MM-dd"

你的聚合：

{
"posts": {
    "mappings": {
        "facebook": {
            "properties": {
                "post_created_time": {
                    "type": "date",
                     "format":"epoch_second"
                },
                "post_description": {
                    "type": "text"
                },
                "post_image": {
                    "type": "text"
                }
            }
        }
    }
  }
}