elasticsearch - 使用 Elasticsearch 地理功能查找按时间排序的最常见位置

Question

我目前有一个ES查询，它使用geohash_grid和date_histogram为我提供了“geo buckets”列表:

  "aggregations": {
"zoomedInView": {
  "filter": {
    "geo_bounding_box": {
      "location": {
        "top_left": "-37, 140",
        "bottom_right": "-38, 146"
      }
    }
  },
  "aggregations": {
    "zoom1": {
      "geohash_grid": {
        "field": "location",
        "precision": 6
      },
      "aggs": {
        "ts": {
          "date_histogram": {
            "min_doc_count" : 1,
            "field": "dateTime",
            "interval": "1m",
            "format": "DDD HH:mm"
          }
         },
         "map_zoom": { 
            "geo_bounds": {
                "field": "location"
            }
        }
      }
    }
  }
}

这给我的结果看起来像:

{
              "key": "r1r0fu",
              "map_zoom": {
                 "bounds": {
                    "top_left": {
                       "lat": -38.81073913909495,
                       "lon": 124.96536672115326
                    },
                    "bottom_right": {
                       "lat": -38.81329075805843,
                       "lon": 124.96823584660888
                    }
                 }
              },
              "ts": {
                 "buckets": [
                    {
                       "key_as_string": "136 20:15",
                       "key": 1463354100000,
                    },                       
                    {
                       "key_as_string": "137 04:30",
                       "key": 1463365800000,
                       "doc_count": 1
                    },
....

{
              "key": "r1r0gx",
              "map_zoom": {
                 "bounds": {
                    "top_left": {
                       "lat": -38.798130828887224,
                       "lon": 124.99871227890253
                    },
                    "bottom_right": {
                       "lat": -38.79820383526385,
                       "lon": 124.99872468411922
                    }
                 }
              },
              "ts": {
                 "buckets": [
                    {
                       "key_as_string": "136 23:21",
                       "key": 1463354460000,
                    },
                    {
                       "key_as_string": "137 02:30",
                       "key": 1463365800000,
                    },
                    {
                       "key_as_string": "137 03:31",
                       "key": 1463369460000,
                    }
                 ]
              }
           },

在上面的示例中，结果按地理位置存储区 r1r0fu和 r1r0gx排序，并且在存储区中按顺序排序了事件的时间(按年HHH:mm格式)及其计数。

我真正想要的是:

1)结果按时间排序，这可能意味着同一存储桶将出现多次。

2)仅在每个存储桶内显示最短和最大时间(如果可能)

因此，上面的结果理想情况下将如下所示:

                {
              "key": "r1r0fu",
              "map_zoom": {
                 "bounds": {
                    "top_left": {
                       "lat": -38.81073913909495,
                       "lon": 124.96536672115326
                    },
                    "bottom_right": {
                       "lat": -38.81329075805843,
                       "lon": 124.96823584660888
                    }
                 }
              },
              "ts": {
                 "buckets": [
                    {
                       "key_as_string": "136 20:15",
                       "key": 1463354100000,
                    },
                ]
              }
            },
            {
              "key": "r1r0gx",
              "map_zoom": {
                 "bounds": {
                    "top_left": {
                       "lat": -38.798130828887224,
                       "lon": 124.99871227890253
                    },
                    "bottom_right": {
                       "lat": -38.79820383526385,
                       "lon": 124.99872468411922
                    }
                 }
              },
              "ts": {
                 "buckets": [
                    {
                       "key_as_string": "136 23:21",
                       "key": 1463354460000,
                    },                
                    {
                       "key_as_string": "137 03:31",
                       "key": 1463369460000,
                    },  
                }
            },
            {
              "key": "r1r0fu",
              "map_zoom": {
                 "bounds": {
                    "top_left": {
                       "lat": -38.81073913909495,
                       "lon": 124.96536672115326
                    },
                    "bottom_right": {
                       "lat": -38.81329075805843,
                       "lon": 124.96823584660888
                    }
                 }
              },
              "ts": {
                 "buckets": [
                    {
                       "key_as_string": "137 04:30",
                       "key": 1463365800000,
                    }
                ]
              }
            },
            ...

结果按时间排序，因此在这种情况下，存储段 r1r0fu出现两次。事件 "key_as_string": "137 02:30",已被隐藏，因为它不是最小或最大日期。

反正有可能吗？

非常感谢!

Answer 1

如果您希望按时间排序结果，则最好将date_histogram聚合与geohash_grid交换为更好，如下所示:

{
  "aggregations": {
    "zoomedInView": {
      "filter": {
        "geo_bounding_box": {
          "location": {
            "top_left": "-37, 140",
            "bottom_right": "-38, 146"
          }
        }
      },
      "aggregations": {
        "ts": {
          "date_histogram": {
            "min_doc_count": 1,
            "field": "dateTime",
            "interval": "1m",
            "format": "DDD HH:mm"
          },
          "aggs": {
            "zoom1": {
              "geohash_grid": {
                "field": "location",
                "precision": 6
              }
            },
            "map_zoom": {
              "geo_bounds": {
                "field": "location"
              }
            }
          }
        }
      }
    }
  }
}

这将解决问题1)。但是，由于现在每个主存储区都将是一个时间存储区，因此您将不再具有最小和最大时间。试试看，看看它是否适合您的需求。