[英]In elastic search aggregate by one field then by two fields using date range
[英]Aggregate Date Range filtered values in elastic search
我需要根據日期(在此處添加字段)過濾一組值,然后按device_id
對其進行分組。 所以我正在使用以下內容:
{
"aggs":{
"dates_between":{
"filter": {
"range" : {
"added" : {
"gte": "2014-07-01 00:00:00",
"lte" :"2014-08-01 00:00:00"
}
}
},
"aggs": {
"group_by_device_id": {
"terms": {
"field": "device_id"
}
}
}
}
}
}
執行查詢時,這給我一個錯誤"Failed to parse source"
。 這是正確的做法嗎?
如果僅執行日期匯總,則顯示的值不在指定的日期范圍內
這是圍繞dates_between
的另一種方式,它是group_by_device_id
的嵌套聚合
"aggs": {
"group_by_device_id": {
"terms": {
"field": "device_id"
},
"aggs": {
"dates_between": {
"filter": {
"range": {
"added": {
"gte": "2014-07-01 00:00:00",
"lte": "2014-08-01 00:00:00"
}
}
}
}
}
}
}
您也可以將過濾器移至查詢中:
{
"query": {
"filtered": {
"query": {
"match_all": {}
},
"filter": {
"range": {
"added": {
"gte": "2014-07-01 00:00:00",
"lte": "2014-08-01 00:00:00"
}
}
}
}
},
"aggs": {
"group_by_device_id": {
"terms": {
"field": "device_id"
}
}
}
}
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.