java - Elasticsearch api - @timestamp 的订单聚合

Question

在我的索引中，我有很多结构不同的文档。所有文档之间的共享 key 是以下 key :(Store,owner,products,timestamp)

{"Store":"books for school","owner":"user_15","products":40,"@timestamp":2020/08/02T18:00, "a1":1,"a2":...}
{"Store":"books for school","owner":"user_15","products":45,"@timestamp":2020/08/02T19:00,"b1":1...}
{"Store":"books for school","owner":"user_17","products":55,"@timestamp":2020/08/02T20:00, "b2":1....}

在我的应用程序中，我试图获取每个商店(所有者、产品)的最新共享 key 。所以对于这个例子，我想得到例子中的最后一个文档。
我试图在所有共享键上创建一个聚合查询，但我不确定如何按日期对内部结果进行排序(以便最新的值排在第一位):

{
  "size": 0,
  "aggs": {
    "store_aggr": {
      "terms": {
        "field": "Store"
      },
      "aggs": {
        "owner_aggr": {
          "terms": {
            "field": "owner"
          }
          }
          ,
            "products_aggr": {
              "terms": {
                "field": "products"
              }
            }
                
        }
      }
    }
  
}

如何通过@timestamp 对查询的内部存储桶进行排序？这样我就可以取第一个值，它肯定是最新的..
另外，如何过滤数据以使文档来自最近两天？我是否需要在 @timestamp 字段上添加查询过滤器？

Answer 1

是的，您需要一个 range查询仅选择最近两天。至于排序——你可以使用有序的top_hits agg 以检索基础文档:

{
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-2d"
      }
    }
  }, 
  "size": 0,
  "aggs": {
    "store_aggr": {
      "terms": {
        "field": "Store"
      },
      "aggs": {
        "owner_aggr": {
          "terms": {
            "field": "owner"
          },
          "aggs": {
            "top_hits_aggr": {
              "top_hits": {
                "sort": {
                  "@timestamp": {
                    "order": "desc"
                  }
                }
              }
            }
          }
        },
        "products_aggr": {
          "terms": {
            "field": "products"
          },
          "aggs": {
            "top_hits_aggr": {
              "top_hits": {
                "sort": {
                  "@timestamp": {
                    "order": "desc"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}