Question

说我有以下数据集：

{
    "date": "2018-08-28T13:56:29",
    "id": "2db53c87bc701085b7c4eae7efabc247"
},

{
    "date": "2018-08-28T13:57:13",
    "id": "c2c74867e70226096c2a279e89df655d"
},

{
    "date": "2018-08-28T13:58:09",
    "id": "2db53c87bc701085b7c4eae7efabc247"
}

我试图获取上个月一个给定ID每天发生的事件数。例如，对于ID 2db53c87bc701085b7c4eae7efabc247，我应该得到2。

我尝试了以下操作：

{
    sort: {
        date: "desc"
    },
    query: {
        bool: {
            must: {
                term: {
                    "id": "2db53c87bc701085b7c4eae7efabc247"
                }
            },
            filter: {
                range: {
                    date: {
                        gte: "now-1m",
                        lte: "now"
                    }
                }
            }
        }
    },
    aggs: {
        daily: {
            date_histogram: {
                field: "date",
                interval: "day"
            }
        }
    }
}

Elasticsearch给我以下输出：

hits: { total: 0, max_score: null, hits: [] },
aggregations: { daily: { buckets: [] } } }

任何帮助将不胜感激。

Answer 1

您当前正在按最后一分钟保存的文档进行筛选。您需要更改日期过滤器，例如“ now-1M”

{
    size:0,
    sort: {
        date: "desc"
    },
    query: {
        bool: {
            must: {
                term: {
                    "id": "2db53c87bc701085b7c4eae7efabc247"
                }
            },
            filter: {
                range: {
                    date: {
                        gte: "now-1M",
                        lte: "now"
                    }
                }
            }
        }
    },
    aggs: {
        daily: {
            date_histogram: {
                field: "date",
                interval: "day"
            }
        }
    }
}

获取每天发生的日期直方图

1 个答案: