elasticsearch hourly histogram calculation -
this dsl returns hours in date field of index.. need total value of "hour value" in index. hope 24 buckets result each buckets contains hour , value in buckets must total sum of fields("respsize") of docs in hour
{    "size":0,    "query":{       "filtered":{          "filter":{          }       }    },    "aggs":{       "aggs1":{          "date_histogram":{             "field":"loggingdate",             "interval":"hour",             "format":"k",             "order":{                "aggs2":"desc"             }          },          "aggs":{             "aggs2":{                "sum":{                   "field":"respsize"                }             }          }       }    } } exmp: returns
"aggs1": {          "buckets": [             {                "key_as_string": "5",                "key": 1452852000000,                "doc_count": 29500,                "aggs2": {                   "value": 1                }             },             {                "key_as_string": "6",                "key": 1452866400000,                "doc_count": 15941,                "aggs2": {                   "value": 2                }             },             {                "key_as_string": "5",                "key": 1452870000000,                "doc_count": 6121,                "aggs2": {                   "value": 3                }             }, but want this:
"aggs1": {          "buckets": [             {                "key_as_string": "5",                "key": 1452852000000,                "doc_count": 29500,                "aggs2": {                   "value": 4                }             },             {                "key_as_string": "6",                "key": 1452866400000,                "doc_count": 15941,                "aggs2": {                   "value": 2                }             }             }, 
you can use terms aggregation then. use below query:
{ "size":0, "query":{   "filtered":{      "filter":{      }   } }, "aggs":{   "aggs1":{      "terms":{         "script": "new     datetime(doc['loggingdate'].value).gethourofday()",          "order":{            "aggs2":"desc"         }      },      "aggs":{         "aggs2":{            "sum":{               "field":"respsize"            }         }      }   }  } } i guess fetch desired result.
Comments
Post a Comment