elasticsearch - 直方图不是从正确的分钟开始，即使添加了过滤器

Question

映射

          "eventTime": {
            "type": "long"
          },

查询

POST some_indices/_search
{
  "size": 0,
  "query": {
    "constant_score": {
      "filter": {
            "range": {                   
              "eventTime": {
                "from": 1563120000000,
                "to": 1565712000000,
                "format": "epoch_millis"
              }
        }
      }
    }
  },
  "aggs": {
      "min_eventTime": { "min" : { "field": "eventTime"} }, 
      "max_eventTime": { "max" : { "field": "eventTime"} }, 
      "time_series": {
        "histogram": {
          "field": "eventTime",
          "interval": 86400000, 
          "min_doc_count" : 0,
          "extended_bounds": {            
            "min": 1563120000000,
            "max": 1565712000000
          }
        }
      }
  }
}

响应

"aggregations": {
    "max_eventTime": {
      "value": 1565539199997
    },
    "min_eventTime": {
      "value": 1564934400000
    },
    "time_series": {
      "buckets": [
        {
          "key": 1563062400000,
          "doc_count": 0
        },
        {
          "key": 1563148800000,
          "doc_count": 0
        },
        {
        ...

题

作为引用明确提到

For filtering buckets, one should nest the histogram aggregation under a range filter aggregation with the appropriate from/to settings.

我正确设置了过滤器(就像 demo一样)，并且 min和 max也提供了证据。

但是为什么 的第一个 key仍然比from(或min_eventTime)小？

所以很奇怪，我现在完全迷路了；(

任何建议将被认真考虑 ;)

引用文献

https://www.elastic.co/guide/en/elasticsearch/reference/5.5/search-aggregations-bucket-histogram-aggregation.html#search-aggregations-bucket-histogram-aggregation

Answer 1

我暂时破解了一个解决方案，但我认为这是Elastic Search中的错误。

我使用的是 date_histogram ，尽管该字段本身是一个长类型，并且通过offset我将起点移到了正确的时间戳。

  "aggs": {
    "time_series": {
      "date_histogram": {
        "field": "eventTime",
        "interval": 86400000,
        "offset": "+16h",
        "min_doc_count": 0,
        "extended_bounds": {
          "min": 1563120000000,
          "max": 1565712000000
        }
      },
      "aggs": {
        "order_amount_total": {
          "sum": {
            "field": "order_amount"
          }
        }
      }
    }
  }

更新

感谢@Val的帮助，我重新考虑一下，并进行了如下测试:

    @Test
    public void testComputation() {
        System.out.println(1563120000000L  % 86400000L); // 57600000
        System.out.println(1563062400000L  % 86400000L); // 0
    }

我想引用该文档

With extended_bounds setting, you now can "force" the histogram aggregation to start building buckets on a specific min value and also keep on building buckets up to a max value (even if there are no documents anymore). Using extended_bounds only makes sense when min_doc_count is 0 (the empty buckets will never be returned if min_doc_count is greater than 0).

但是我相信 specific min value应该是 0, interval, 2 * interval, 3 * interval, ....之一，而不是我在问题中使用的随机值。

因此，基本上我可以使用直方图的 offset来解决此问题，如下所示。

我实际上根本不需要date_histogram。

       "histogram": {
          "field": "eventTime",
          "interval": 86400000, 
          "offset": 57600000,
          "min_doc_count" : 0,
          "extended_bounds": {            
            "min": 1563120000000,
            "max": 1565712000000
          }
        }

Elastic Search成员@polyfractal发布的清晰解释(感谢您对晶体的详细解释)也证明了相同的逻辑，更多细节可以在 here中找到。

我想在这里引用设计的原因:

if we cut the aggregation off right at the extended_bounds.min/max, we would generate buckets that are not the full interval and that would break many assumptions about how the histogram works.