elasticsearch - “aggs”查询的输出结果不正确

Question

我有一个查询，用于查询给定日期时间窗口(即2017-02-17T15:00:00.000和2017-02-17T16:00:00.000之间)中的条目数。执行此查询时，我得到的结果不正确(最好说结果是意外的):

POST /myindex/_search
{
  "size": 0,
  "aggs": {
    "range": {
        "date_range": {
            "field": "Datetime",
            "ranges": [
                { "to": "2017-02-17T16:00:00||-1H/H" }, 
                { "from": "2017-02-17T16:00:00||/H" } 
            ]
        }
    }
}
}

这是输出:

{
  "took": 0,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 11,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "range": {
      "buckets": [
        {
          "key": "*-2017-02-17T15:00:00.000Z",
          "to": 1487343600000,
          "to_as_string": "2017-02-17T15:00:00.000Z",
          "doc_count": 0
        },
        {
          "key": "2017-02-17T16:00:00.000Z-*",
          "from": 1487347200000,
          "from_as_string": "2017-02-17T16:00:00.000Z",
          "doc_count": 0
        }
      ]
    }
  }
}

在 myindex中，我有两个条目，它们具有 Datetime的以下值:

2017-02-17T15:15:00.000Z
2017-02-17T15:02:00.000Z

因此，结果应等于2。

我不明白如何解释当前输出。哪些字段定义条目数？

更新:

数据结构:

PUT /myindex
{
    "mappings": {
      "intensity": {
      "_all": {
        "enabled": false
      },
        "properties": {
          "Country_Id": {
            "type":"keyword"
          },
          "Datetime": {
            "type":"date"
          }
        }
      }
    }
}

样本数据:

{
  "took": 0,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 5,
    "max_score": 1,
    "hits": [
      {
        "_index": "myindex",
        "_type": "intensity",
        "_id": "4",
        "_score": 1,
        "_source": {
          "Country_Id": "1",
          "Datetime": "2017-02-18T15:01:00.000Z"
        }
      },
      {
        "_index": "myindex",
        "_type": "intensity",
        "_id": "6",
        "_score": 1,
        "_source": {
          "Country_Id": "1",
          "Datetime": "2017-03-16T16:15:00.000Z"
        }
      },
      {
        "_index": "myindex",
        "_type": "intensity",
        "_id": "1",
        "_score": 1,
        "_source": {
          "Country_Id": "1",
          "Datetime": "2017-02-17T15:15:00.000Z"
        }
      },
      {
        "_index": "myindex",
        "_type": "intensity",
        "_id": "7",
        "_score": 1,
        "_source": {
          "Country_Id": "1",
          "Datetime": "2017-03-16T16:18:00.000Z"
        }
      },
      {
        "_index": "myindex",
        "_type": "intensity",
        "_id": "3",
        "_score": 1,
        "_source": {
          "Country_Id": "1",
          "Datetime": "2017-02-17T15:02:00.000Z"
        }
      }
    ]
  }
}

我得到的答案:

{
  "took": 2,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 11,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "range": {
      "buckets": [
        {
          "key": "2017-02-17T15:00:00.000Z-2017-02-17T16:00:00.000Z",
          "from": 1487343600000,
          "from_as_string": "2017-02-17T15:00:00.000Z",
          "to": 1487347200000,
          "to_as_string": "2017-02-17T16:00:00.000Z",
          "doc_count": 0
        }
      ]
    }
  }
}

Answer 1

您的范围有误，请改为这样

POST /myindex/_search
{
  "size": 0,
  "aggs": {
    "range": {
        "date_range": {
            "field": "Datetime",
            "ranges": [
                { 
                   "from": "2017-02-17T16:00:00Z||-1H/H",
                   "to": "2017-02-17T16:00:00Z||/H" 
                }
            ]
        }
    }
}
}