基于百分比的过滤弹性搜索

时间:2020-02-13 19:20:48

标签: elasticsearch elasticsearch-aggregation percentile

我正在尝试计算一个聚集的派生字段(延迟)->的第15个百分位数和第75个百分位数,并尝试检索字段值>(p75-p15)的那些记录。我能够计算aggs和阈值,但无法过滤出所需的值。尝试以下查询,并遇到“ buckets_path必须引用数字值或单值数字度量聚合,得到:java.lang.Object []”。我只是想检索平均延迟>阈值的记录。有指针吗?

"aggs": {
        "by_name": {
            "terms": {
                "script": "doc['name'].value + ',' + doc['valf'].value ,
                "size": 5000
            },
            "aggs": {
                "single_round_block": {
                    "date_histogram": {
                        "field": "start_time",
                        "interval": "300s"
                    },
                    "aggs": {
                        "overallSumLatency": {
                            "sum": {
                                "field": "sum_latency_ms"
                            }
                        },
                        "overallNumLatencyMeasurements": {
                            "sum": {
                                "field": "num_valid_latency_measurements"
                            }
                        },

                           "avgLatency": {
                            "bucket_script": {
                                "buckets_path": {
                                    "sumLatency": "overallSumLatency",
                                    "numPoints": "overallNumLatencyMeasurements"
                                },
                                "script": "(params.numPoints == 0)?0:(params.sumLatency / params.numPoints)"
                            }
                        }
                    }
                },
                "percentiles_vals": {
            "percentiles_bucket": {
                "buckets_path": "single_round_block>avgLatency",
                "percents": [ 15.0,75.0] 
            }
        },

        "threshold":{
          "bucket_script": {
            "buckets_path": {
              "perc75":"percentiles_vals[75.0]",
              "perc15":"percentiles_vals[15.0]"
            },
            "script": "Math.abs(params.perc75 - params.perc15)"
          }

        },
                "filter_out_records": {
                    "bucket_selector": {
                        "buckets_path": {
                            "threshold":"threshold",
                            "avgLatency":"single_round_block>avgLatency"
                        },
                        "script": "params.avgLatency > params.threshold"
                    }
                }
            }
        }
    }
}

0 个答案:

没有答案