Elasticsearch总和来自最大

时间:2018-12-06 18:45:39

标签: elasticsearch aggregate elastic-beats

我需要一些帮助来查找所有主题中的消息总数。

以下文档具有+百万个主题,分区和偏移量。

我需要获取偏移总数:

"kafka": {
  "partition": {
    "topic": {
      "name": "testTopic20181206"
    },
    "broker": {
      "id": 4,
      "address": "localhost:9092"
    },
    "partition": {
      "insync_replica": true,
      "id": 0,
      "leader": 3,
      "replica": 1
    },
    "offset": {
      "newest": 17330676,
      "oldest": 0
   }
  }

我正在使用的查询是:

  GET metricbeat-6*/_search
  {
    "size": 0,
    "aggs": {
      "Topic": {
        "terms": {
          "field": "kafka.partition.topic.name",
          "size": 10000
        },
        "aggregations": {
          "Partition": {
            "terms": {
              "field": "kafka.partition.partition.id"
            },
            "aggregations": {
            "Partition": {
              "max": {
                "field": "kafka.partition.offset.newest"
              }
            }
            }

          }
        }
      }
  }

}

0 个答案:

没有答案