elasticsearch hourly histogram calculation -
this dsl returns hours in date field of index.. need total value of "hour value" in index. hope 24 buckets result each buckets contains hour , value in buckets must total sum of fields("respsize") of docs in hour
{ "size":0, "query":{ "filtered":{ "filter":{ } } }, "aggs":{ "aggs1":{ "date_histogram":{ "field":"loggingdate", "interval":"hour", "format":"k", "order":{ "aggs2":"desc" } }, "aggs":{ "aggs2":{ "sum":{ "field":"respsize" } } } } } }
exmp: returns
"aggs1": { "buckets": [ { "key_as_string": "5", "key": 1452852000000, "doc_count": 29500, "aggs2": { "value": 1 } }, { "key_as_string": "6", "key": 1452866400000, "doc_count": 15941, "aggs2": { "value": 2 } }, { "key_as_string": "5", "key": 1452870000000, "doc_count": 6121, "aggs2": { "value": 3 } },
but want this:
"aggs1": { "buckets": [ { "key_as_string": "5", "key": 1452852000000, "doc_count": 29500, "aggs2": { "value": 4 } }, { "key_as_string": "6", "key": 1452866400000, "doc_count": 15941, "aggs2": { "value": 2 } } },
you can use terms aggregation
then. use below query:
{ "size":0, "query":{ "filtered":{ "filter":{ } } }, "aggs":{ "aggs1":{ "terms":{ "script": "new datetime(doc['loggingdate'].value).gethourofday()", "order":{ "aggs2":"desc" } }, "aggs":{ "aggs2":{ "sum":{ "field":"respsize" } } } } } }
i guess fetch desired result.
Comments
Post a Comment