如何根据弹性聚合的分类结果提取文档?

时间:2019-03-14 08:29:15

标签: elasticsearch logstash kibana elasticsearch-aggregation

我正在执行聚合查询。该查询将获取所有的分钟数据并执行汇总以创建小时结果。获得的结果集是-

{
  "took" : 7,
  "timed_out" : false,
  "_shards" : {
    "total" : 7,
    "successful" : 7,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 1440,
    "max_score" : 0.0,
    "hits" : [ ]
  },
  "aggregations" : {
    "time-interval" : {
      "buckets" : [
        {
          "key_as_string" : "2019-03-11T00:00:00.000-05:00",
          "key" : 1552280400000,
          "doc_count" : 1440,
          "http-server" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "http-server",
                "doc_count" : 960,
                "1" : {
                  "value" : 0.16463961166666666
                },
                "2" : {
                  "value" : 0.0
                },
                "3" : {
                  "value" : 3.2266329166666665
                },
                "4" : {
                  "doc_count_error_upper_bound" : 0,
                  "sum_other_doc_count" : 0,
                  "buckets" : [
                    {
                      "key" : "https-epmp-admin",
                      "doc_count" : 480,
                      "1" : {
                        "value" : 0.16463961166666666
                      },
                      "2" : {
                        "value" : 0.0
                      },
                      "3" : {
                        "value" : 0.0
                      }
                    },
                    {
                      "key" : "Admin",
                      "doc_count" : 480,
                      "1" : {
                        "value" : 0.0
                      },
                      "2" : {
                        "value" : 0.0
                      },
                      "3" : {
                        "value" : 3.2266329166666665
                      }
                    }
                  ]
                }
              }
            ]
          }
        }
      ]
    }
  }
}

总共获取了1440个文档,并且对那些文档执行了汇总逻辑。现在对我来说,下一个任务是提取汇总结果。我该如何转换将存储桶下的聚合结果考虑在内的数据,而不是1440个文档,如何将数据转换为所需的json格式并将数据提取到索引。我该如何实现?

0 个答案:

没有答案