弹性搜索中的Date_Histogram

Question

Today I had a task where I have to aggregate the data bucketed by 1 hour interval. So I used Date_Histogram aggregation in elastic search. Below is the query:

GET test-2017.02.01/_search
{
  "size" : 0,

  "aggs": {
    "range_aggs": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "hour",
        "format": "yyyy-MM-dd HH:mm"
      }
    }
  }

}

I got the below result:

    "aggregations": {
    "range_aggs": {
      "buckets": [
        {
          "key_as_string": "2017-02-01 12:00",
          "key": 1485950400000,
          "doc_count": 4027
        },
        {
          "key_as_string": "2017-02-01 13:00",
          "key": 1485954000000,
          "doc_count": 0
        }
      ]
    }
  }

Every is good till now as I have run this query for one day, but when I run the query for multiple days in that case, I am getting the keys per day. My question is - How can I get the data for the hour intervals(ex- 9am to 10am, 10am to 11am, ...etc) across all the days ?

Answer 1

    {
  "aggs": {
    "range_aggs": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "day",
        "min_doc_count": 1
      },
      "aggs": {
        "range_aggs": {
          "date_histogram": {
            "field": "@timestamp",
            "interval": "hour"
          }
        }
      }
    }
  }
}

If you need response grouped by hour, on across days, try this one.