个人中心
文章发布
退出
作者热门文章
- html - 出于某种原因，IE8 对我的 Sass 文件中继承的 html5 CSS 不友好？
- JMeter 在响应断言中使用 span 标签的问题
- html - 在 :hover and :active? 上具有不同效果的 CSS 动画
- html - 相对于居中的 html 内容固定的 CSS 重复背景？
25
4
一些索引包含一个名为clientip的字段，我需要在指定的时间戳范围内查找唯一的IP地址计数。为了达成这个;
在下面运行查询；
GET /testbaguni-2020.10/_search
{
"aggs": {
"1": {
"cardinality": {
"field": "clientip"
}
}
},
"size": 0,
"stored_fields": [
"*"
],
"script_fields": {
"hour_of_day": {
"script": {
"source": "doc['timestamp'].value.getHour()",
"lang": "painless"
}
}
},
"docvalue_fields": [
{
"field": "@timestamp",
"format": "date_time"
},
{
"field": "timestamp",
"format": "date_time"
}
],
"_source": {
"excludes": []
},
"query": {
"bool": {
"must": [],
"filter": [
{
"match_all": {}
},
{
"match_all": {}
},
{
"range": {
"timestamp": {
"gte": "2020-10-05T18:18:10.063Z",
"lte": "2020-10-13T18:18:10.063Z",
"format": "strict_date_optional_time"
}
}
}
],
"should": [],
"must_not": []
}
}
}
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 0,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"1" : {
"value" : 0
}
}
}
GET /testbaguni-2020.10/_search
{
"query": {
"match": {
"fields.clientip":"127.0.0.1"
}
}
}
{
"took" : 1,
"hits" : {
"total" : {
"value" : 2,
"relation" : "eq"
},
"max_score" : 0.18232156,
"hits" : [
{
"_index" : "testbaguni-2020.10",
"_type" : "_doc",
"_id" : "tGgRHnUBYOJjF0gPoog3",
"_score" : 0.18232156,
"_source" : {
"@timestamp" : "2020-10-12T21:25:20.7164826+03:00",
"fields" : {
"hour_of_day" : 21,
"clientip" : "127.0.0.1",
...
}
}
},
{
"testbaguni-2020.10" : {
"mappings" : {
"properties" : {
"@timestamp" : {
"type" : "date"
},
"exceptions" : {
"properties" : {
"ClassName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Depth" : {
"type" : "long"
},
"HResult" : {
"type" : "long"
},
"Message" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"RemoteStackIndex" : {
"type" : "long"
},
"Source" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"StackTraceString" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"fields" : {
"properties" : {
"ActionId" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ActionName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ActionResult" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"AssemblyName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ContentLength" : {
"type" : "long"
},
"ContentType" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Controller" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"CreationTime" : {
"type" : "date"
},
"Destination" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ElapsedMilliseconds" : {
"type" : "float"
},
"EndpointName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Environment" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"EventId" : {
"properties" : {
"Id" : {
"type" : "long"
},
"Name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"ExceptionDetail" : {
"properties" : {
"HResult" : {
"type" : "long"
},
"InnerException" : {
"properties" : {
"Class" : {
"type" : "long"
},
"ClientConnectionId" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Data" : {
"properties" : {
"HelpLink" : {
"properties" : {
"BaseHelpUrl" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"EvtID" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"EvtSrc" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"LinkId" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ProdName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
},
"ErrorCode" : {
"type" : "long"
},
"Errors" : {
"properties" : {
"Class" : {
"type" : "long"
},
"LineNumber" : {
"type" : "long"
},
"Message" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Number" : {
"type" : "long"
},
"Server" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Source" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"State" : {
"type" : "long"
}
}
},
"HResult" : {
"type" : "long"
},
"InnerException" : {
"properties" : {
"ErrorCode" : {
"type" : "long"
},
"HResult" : {
"type" : "long"
},
"Message" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"NativeErrorCode" : {
"type" : "long"
},
"Type" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"LineNumber" : {
"type" : "long"
},
"Message" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Number" : {
"type" : "long"
},
"Server" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Source" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"State" : {
"type" : "long"
},
"Type" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"Message" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Source" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Type" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"FullName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Host" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"HostingRequestFinishedLog" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"HostingRequestStartingLog" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"MachineName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Method" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"MethodInfo" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"OrderStatus" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ParentId" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Path" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"PathBase" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"PhysicalPath" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Protocol" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"QueryString" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"RequestId" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"RequestPath" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"RouteData" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Scheme" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"SourceContext" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"SpanId" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"StatusCode" : {
"type" : "long"
},
"TraceId" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Type" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ValidationState" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"ViewName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"VirtualPath" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"clientip" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"hour_of_day" : {
"type" : "long"
}
}
},
"level" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"message" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"messageTemplate" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"renderings" : {
"properties" : {
"HostingRequestFinishedLog" : {
"properties" : {
"Format" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Rendering" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"HostingRequestStartingLog" : {
"properties" : {
"Format" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"Rendering" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
}
}
}
}
}
最佳答案
您使用了错误的字段名。您正在cardinality上查询clientip，但必须在fields.clientip上执行。您的cardinality查询将如下所示:
{
"aggs": {
"1": {
"cardinality": {
"field": "fields.clientip"
}
}
}
关于elasticsearch - elasticsearch aggs唯一的IP地址，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/64333210/
25
4
0
我有两种方法来汇总数据。 首先，我过滤mysql数据并进行汇总 其次，i aggs将数据过滤为aggs。 如下: 我发现了不同的结果，我不知道为什么。 有人可以解释吗？ 最佳答案 从Docs By d
在一个具体问题上，假设我有一个 DataFrame DF word tag count 0 a S 30 1 the S 20 2 a T
我正在使用Python进行数据分析，但我遇到了部分CH的问题。9(数据聚合和分组操作)部分，介绍“使用函数分组”。。具体地说，如果我使用GroupBy对象方法或Numpy定义的函数，一切都会正常工作。
接听this question原来 df.groupby(...).agg(set) 和 df.groupby(...).agg(lambda x: set(x)) 正在产生不同的结果。 数据: df
如何在这样的字符串列中执行最大值？ dataframe = pandas.DataFrame.from_dict( { "DEP
我有一个查询，用于查询给定日期时间窗口(即2017-02-17T15:00:00.000和2017-02-17T16:00:00.000之间)中的条目数。执行此查询时，我得到的结果不正确(最好说结果是
我正在尝试进行一些聚合查询并遇到一些问题。 GET /my_index/_search { "size" : 0, "aggs":{ "group_by":{ "terms": {
对于pandas agg，有没有办法根据数据类型指定聚合函数？例如，对象类型的所有列都获得“第一”，所有 float 获得“平均值”，等等？以避免必须输入所有列及其各自的聚合函数。 示例数据: imp
这是我当前的代码: pipe_exec_df_final_grouped = pipe_exec_df_final.groupBy("application_id").agg(collect_list
我有一个简单的 dataframe (df)，如下所示: index Job Person 1 j1 Cathy 2 j2 Mark 3 j3 Cathy 4
我正在尝试对术语(count_bucket)进行AVG计数，但是出现错误: "buckets_path must reference either a number value or a single
我正在执行弹性查询并使用 REST 调用读取 java 代码中的响应。 当我阅读响应时，字段的顺序 - 200、204、4xx、5xx 不会按照响应中的顺序返回。 在下面找到示例请求 GET appl
我希望对文档下的属性值进行 Max 聚合，该属性是复杂对象(键和值)的列表。这是我的数据: [{ "id" : "1", "listItems" : [
我使用 Elasticsearch 来存储我的生物数据。 我尝试使用过滤后的 aggs 进行查询，但返回的数据不是我想要的。 问题来自这样一个事实，即我为每个样本都有一个“d_”属性，它是一个数组。我
当我尝试运行此查询时，elasticsearch无法回答，并且发生大量缓存逐出(与字段缓存有关)。 我不想在此查询中缓存任何字段，因为这是一个分析查询，我每天只运行一次。有什么办法可以在不使用字段缓存
我想将 DataFrame.agg 的输出转换为一个系列，其中索引是列名称和 agg 函数名称的组合。 看我有 In [132]: df = pd.DataFrame({ ...:
我想根据索引的第二级对具有多重索引的数据帧应用不同的函数。 例如，对于数据框: In [4]: df = pd.DataFrame({'a': [1,2,6,7],'b': [7,1,4,5]}, i
假设我有这样的代码: meanData = all_data.groupby(['Id'])[features].agg('mean') 这按'Id' 值对数据进行分组，选择所需的特征，并通过计算的'
下面是我的数据框的一个小样本，它有 25000 奇数行长: In [58]: df Out[58]: Send_Agent Send_Amount 0 ADR000264 361
假设我有一个 pandas dataFrame (data_stores) 类似于以下内容: store| item1 | item2 | item3 ------------------------
我是一名优秀的程序员,十分优秀！