elasticsearch - 检索总的唯一值计数kibana + Elasticsearch

Question

根据此问题和答案“How to retrieve unique count of a field using Kibana + Elastic Search”
我已经能够从我们的Apache日志中收集唯一IP地址的单个计数，但是，我真正想要做的是能够显示单个IP地址的计数，即有多少个唯一访问者。

我想我需要使用terms_stats方面来执行此操作，但我不知道将什么设置为“value_field”

Answer 1

当前版本的kibana无法做到这一点。

但我有实现此目的的方法是创建自定义直方图面板。

要创建自定义直方图面板，只需复制现有的直方图并修改config.js，module.js即可将所有路径引用更改为新面板。

覆盖doSearch函数以使用查询http://www.elasticsearch.org/blog/count-elasticsearch/

并更新结果解析逻辑。

寻找功能

b.get_data = function(a，j，k)

                return b.populate_modal(n), p = n.doSearch(), p.then(function(c) {
                    if (b.panelMeta.loading = !1, 0 === j && (b.legend = [], b.hits = 0, a = [], b.annotations = [], k = b.query_id = (new Date).getTime()), d.isUndefined(c.error)) {
                        if (b.query_id === k) {
                            var i, n, p, q = 0;
                            o = JSON.parse("[{\"query\":\"*\",\"alias\":\"\",\"color\":\"#7EB26D\",\"id\":0,\"pin\":false,\"type\":\"lucene\",\"enable\":true,\"parent\" : 0}]");
                            d.each(o, function(e) {
                                //alert(JSON.stringify(c));
                                //var f = c.aggregations.monthly.buckets[e.id];                                 
                                if (d.isUndefined(a[q]) || 0 === j) {
                                    var h = {interval: m,start_date: l && l.from,end_date: l && l.to,fill_style: b.panel.derivative ? "null" : b.panel.zerofill ? "minimal" : "no"};
                                    i = new g.ZeroFilled(h), n = 0, p = {}
                                } else
                                    i = a[q].time_series, n = a[q].hits, p = a[q].counters;
                                d.each(c.aggregations.monthly.buckets, function(a) {
                                    var c;
                                    n += a.visitor_count.value, b.hits += a.visitor_count.value, p[a.key] = (p[a.key] || 0) + a.visitor_count.value, "count" === b.panel.mode ? c = (i._data[a.key] || 0) + a.visitor_count.value : "mean" === b.panel.mode ? c = ((i._data[a.key] || 0) * (p[a.key] - a.visitor_count.value) + a.mean * a.visitor_count.value) / p[a.key] : "min" === b.panel.mode ? c = d.isUndefined(i._data[a.key]) ? a.min : i._data[a.key] < a.min ? i._data[a.key] : a.min : "max" === b.panel.mode ? c = d.isUndefined(i._data[a.key]) ? a.max : i._data[a.key] > a.max ? i._data[a.key] : a.max : "total" === b.panel.mode && (c = (i._data[a.key] || 0) + a.total), i.addValue(a.key, c)
                                }), b.legend[q] = {query: e,hits: n}, a[q] = {info: e,time_series: i,hits: n,counters: p}, q++
                            }), b.panel.annotate.enable && (b.annotations = b.annotations.concat(d.map(c.hits.hits, function(a) {
                                var c = d.omit(a, "_source", "sort", "_score"), g = d.extend(e.flatten_json(a._source), c);
                                return {min: a.sort[1],max: a.sort[1],eventType: "annotation",title: null,description: "<small><i class='icon-tag icon-flip-vertical'></i> " + g[b.panel.annotate.field] + "</small><br>" + f(a.sort[1]).format("YYYY-MM-DD HH:mm:ss"),score: a.sort[0]}
                            })), b.annotations = d.sortBy(b.annotations, function(a) {
                                return a.score * ("desc" === b.panel.annotate.sort[1] ? -1 : 1)
                            }), b.annotations = b.annotations.slice(0, b.panel.annotate.size))
                        }
                    } else
                        b.panel.error = b.parse_error(c.error);
                    b.$emit("render", a), j < h.indices.length - 1 && b.get_data(a, j + 1, k)
                })