elasticsearch - 如何建立对 “new”属性进行计数的日期直方图查询

Question

我正在从设备中收集数据，我想了解新设备何时上线。这些文件的格式为:

{
  "device_id": "ue-0000"
}

我可以通过使用嵌套术语聚合进行日期直方图聚合来查询某个时间段内的 Activity 设备，但是我不知道如何表达“从索引中较早出现 device_id的存储桶中过滤出匹配项”的逻辑。

这是我当前的查询:

{
  "query": {
    "filtered": {
      "filter": {
        "range": {
          "timestamp": {
            "gte": "2015/12/08",
            "lte": "2016/01/08"
          }
        }
      }
    }
  },
  "aggregations": {
    "over_time": {
      "aggregations": {
        "app_count": {
          "terms": {
            "field": "app"
          }
        }
      },
      "date_histogram": {
        "field": "timestamp",
        "interval": "day",
        "min_doc_count": 0,
        "extended_bounds": {
          "min": "2015/12/08",
          "max": "2016/01/08"
        }
      }
    }
  }
}

我有这样的文档:

{
    "timestamp": "2015/12/15",
    "device_id": "1"
}
{
    "timestamp": "2015/12/16",
    "device_id": "2"
}
{
    "timestamp": "2015/12/20",
    "device_id": "1"
}

我想返回以下内容:

{
  "aggregations": {
    "over_time": {
      "buckets": [
        {
          "key_as_string":"2015/12/15 00:00:00",
          "key":1449532800000,
          "doc_count":1,
          "new_devices":{
            "doc_count_error_upper_bound":0,
            "sum_other_doc_count":0,
            "buckets":[{"device_id": "1"}]}
        },
        {
          "key_as_string":"2015/12/16 00:00:00",
          "key":1449532800000,
          "doc_count":1,
          "new_devices":{
            "doc_count_error_upper_bound":0,
            "sum_other_doc_count":0,
            "buckets":[{"device_id": "2"}]}
        },
        // [[ SNIP ]]
        {
          "key_as_string":"2015/12/20 00:00:00",
          "key":1449532800000,
          "doc_count":0, // there are no new device_ids on this date
          "new_devices":{
            "doc_count_error_upper_bound":0,
            "sum_other_doc_count":0,
            "buckets":[]}
        }
      ]
    }
  }
}

Answer 1

我认为您需要在terms aggregation上再添加一个timestamp，这只会为您提供最新的唯一设备。试试这个

{
  "query": {
    "filtered": {
      "filter": {
        "range": {
          "timestamp": {
            "gte": "2015/12/08",
            "lte": "2016/01/08"
          }
        }
      }
    }
  },
  "size": 0,
  "aggs": {
    "unique_device": {
      "terms": {
        "field": "device_id",
        "size": 10
      },
      "aggs": {
        "unique_date": {
          "terms": {
            "field": "timestamp",
            "size": 1,                   
            "order": {
              "_term": "asc"
            }
          },
          "aggs": {
            "latest_device": {
              "date_histogram": {
                "field": "timestamp",
                "interval": "day",
                "min_doc_count": 0,
                "extended_bounds": {
                  "min": "2015/12/08",
                  "max": "2016/01/08"
                }
              }
            }
          }
        }
      }
    }
  }
}

此处 size中的 order和 timestamp aggregation仅会为您提供 date histogram的新设备。

这有帮助吗？