ElasticSearch:查询语法很麻烦

时间:2018-08-09 10:36:37

标签: elasticsearch elasticsearch-painless

我刚刚开始研究ElasticSearch,用Painless编写很痛苦。很难看到括号之间的连接,太多的空间。我正在进行离群值检测,例如,这是代码的样子:

  "query": {
    "filtered": {
      "filter": {
        "range": {
          "hour": {
            "gte": "{{start}}",
            "lte": "{{end}}"
          }
        }
      }
    }
  },
  "size": 0,
  "aggs": {
    "metrics": {
      "terms": {
        "field": "metric",
        "size": 5
      },
      "aggs": {
        "queries": {
          "terms": {
            "field": "query",
            "size": 500
          },
          "aggs": {
            "series": {
              "date_histogram": {
                "field": "hour",
                "interval": "hour"
              },
              "aggs": {
                "avg": {
                  "avg": {
                    "field": "value"
                  }
                },
                "movavg": {
                  "moving_avg": {
                    "buckets_path": "avg",
                    "window": 24,
                    "model": "simple"
                  }
                },
                "surprise": {
                  "bucket_script": {
                    "buckets_path": {
                      "avg": "avg",
                      "movavg": "movavg"
                    },
                    "script": "(avg - movavg).abs()"
                  }
                }
              }
            },
            "largest_surprise": {
              "max_bucket": {
                "buckets_path": "series.surprise"
              }
            }
          }
        },
        "ninetieth_surprise": {
          "percentiles_bucket": {
            "buckets_path": "queries>largest_surprise",
            "percents": [
              90
            ]
          }
        }
      }
    }
  

我通过为代码创建自己的约定以使其可读来解决此问题。它仅基于右括号,缩进有助于提高可读性。只要找到括号的组,它就会打开一个新行(“ {{start}}”等行内除外)是这样的:

{
"query":{"filtered":{"filter":{"range":{"hour":{"gte":"{{start}}","lte":"{{end}}"}}}}},                                                                                 
"size":0,
"aggs":{"metrics":{"terms":{"field":"metric",“size”:5},
		    "aggs":{"queries":{"terms":{"field":"query","size":500},
				        "aggs":{"series": {"date_histogram":{"field":"hour","interval":"hour"},
						                     "aggs":{"avg":{"avg":{"field":"value"}},
                                                                      ....

我想知道是否还有其他有助于提高可读性并遵循代码行的约定。社区中正在使用什么?

代码来自:https://www.elastic.co/blog/implementing-a-statistical-anomaly-detector-part-1

0 个答案:

没有答案