Question

我想计算指定字段数据的百分比。这是我的Restful API：

Restful API：

GET _search
{
"_source": {
"includes": [ "FIRST_SWITCHED","LAST_SWITCHED","IPV4_DST_ADDR","L4_DST_PORT","IPV4_SRC_ADDR","L7_PROTO_NAME","IN_BYTES","IN_PKTS","OUT_BYTES","OUT_PKTS"]
},
"from" : 0, "size" : 10000,
"query": {
"bool": {
"must": [
{
    "match" : { "_index" : "logstash-2017.12.22" }
},
{
    "match_phrase":{"IPV4_SRC_ADDR":"192.168.0.159"}
},

{
  "range" : {
    "LAST_SWITCHED" : {
        "gte" : 1513683600
    }
    }
}

]
}
},
"aggs": {
"IN_PKTS": {
"sum": {
  "field": "IN_PKTS"
}
},
"IN_BYTES": {
"sum": {
  "field": "IN_BYTES"
}
},
"OUT_BYTES": {
"sum": {
  "field": "OUT_BYTES"
}
},
"OUT_PKTS": {
"sum": {
  "field": "OUT_PKTS"
}
},
"percent":{
"significant_terms" : {
        "field" : "L7_PROTO_NAME",
        "percentage":{}
    }},
"protocol" : {
     "terms" : {
         "field" : "PROTOCOL",
         "include" : ["17", "6"]      
        }
},
"Using_port_count" : {                 
    "cardinality" : {
        "field" : "L4_SRC_PORT"
    }
}
}
}

但有一些错误。这是错误消息：

错误消息：

＆＃34;原因＆＃34;：＆＃34;默认情况下，文本字段禁用Fielddata。在[L7_PROTO_NAME]上设置fielddata = true，以便通过反转索引来加载内存中的fielddata。请注意，这可能会占用大量内存。或者，也可以使用关键字字段。＆＃34;

提前谢谢你！

Answer 1

好的，我找到了答案！

只需在此处添加.keyword即可运行！

＆＃34;字段＆＃34; ：＆＃34; L7_PROTO_NAME.keyword＆＃34;

计算字符字段的百分比

1 个答案: