Question

我有以下给定的查询，该查询应该找到给定小时范围的平均条目数，即从15:00到16:00。

此查询无法正常运行。如何指定小时范围（没有日期）并找到每个范围的平均条目数？

POST /myindex/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {"term": {"EventId": "11"}},
        {"term": {"EventType": "Type1"}}
      ]
    }
  },
  "aggs": {
    "range": {
        "date_range": {
            "field": "Datetime",
            "ranges": [
                { 
                   "from": "16:00-1H/H",
                   "to": "16:00/H" 
                }
            ]
        }
    }
  }
}

我应该使用移动平均线吗？怎么样？

我试过这个，但我很感激有人可以帮我完成这个查询。我不知道"value_count" : { "field" : "EventHour"}是否是计算条目数量的正确方法。如何在此查询中正确添加小时数范围？：

    POST /myindex/_search
    {
      "size": 0,
      "query": {
        "bool": {
          "filter": [
            {"term": {"EventId": "11"}},
            {"term": {"EventType": "Type1"}},
{
          "script": {
            "script": "doc.date.date.getHourOfDay() >= min && doc.date.date.getHourOfDay() <= max",
            "params": {
              "min": 15,
              "max": 16
            }
          }
        }
          ]
        }
      },
      "aggs": {
        "hourly_intensity": {
          "date_histogram": {
            "field": "Datetime",
            "interval": "hour"
          },
          "aggs": {
            "count_of_events": {
              "value_count" : { "field" : "EventHour"}
            }
          }
        },
        "hourly_avg_count": {
          "avg_bucket": {
            "buckets_path": "hourly_intensity>count_of_events" 
          }
        }
      }
    }

Answer 1

我自己找到了解决方案：

   POST /myindex/_search
    {
      "size": 0,
      "query": {
        "bool": {
          "filter": [
            {"term": {"EventId": "11"}},
            {"term": {"EventType": "Type1"}},
            {"term": {"EventHour": 15}}
          ]
        }
      },
      "aggs": {
        "hourly_intensity": {
          "date_histogram": {
            "field": "Datetime",
            "interval": "hour"
          },
          "aggs": {
            "count_of_events": {
              "value_count" : { "field" : "EventHour"}
            }
          }
        },
        "avg_num_events_per_hour": {
          "avg_bucket": {
            "buckets_path": "hourly_intensity>count_of_events" 
          }
        }
      }
}

查询以查找给定小时范围的平均条目数

1 个答案: