我有时间戳字段 (yyyy-mm-dd T hh:mm:ss)。我想计算每个设备 ID 在给定的一天中存在多少个不同的小时数。如何在 kibana 中做到这一点？
这是我的实际文件。
https://drive.google.com/open?id=1JRZj8myVu1UHJ3jxZzzb8LSKKMicY0Qi 例如。
Doc1=
{
name = "heart_beat"
date= "2019-06-05 T 12:10:00"
"device_id" = "abc"
}
Doc2=
{
name="heart_beat"
date="2019-06-05 T 09:10:00"
"device_id" = "xyz"
}
Doc3=
{
name="heart_beat"
date="2019-06-05 T 12:15:00"
"device_id" = "pqr"
}
Doc4=
{
name="heart_beat"
date="2019-06-05 T 07:10:00"
"device_id" = "def"
}
Doc5=
{
name="heart_beat"
date="2019-06-07 T 09:10:00"
"device_id" = "xyz"
}
Doc6=
{
name="heart_beat"
date="2019-06-07 T 12:15:00"
"device_id" = "pqr"
}
答案应该是
“2019-06-05”设备-“abc”小时数-1
“2019-06-05”设备-“pqr”小时数-1
“2019-06-05”设备-“xyz”小时-1
“2019-06-05”设备-“def”小时-1
“2019-06-07”设备-“xyz”小时-1
- “2019-06-07”设备-“pqr”小时数-1
最佳答案
我正在使用脚本来获取不同的时间。 查询有 2 个聚合 1. terms aggregations——它给出了所有不同的时间和其中的文档数量 2. 基数聚合——给出不同小时数
您可以根据需要保留其中一个或两个
映射:
PUT testindex4/_mapping
{
"properties": {
"name":{
"type":"text"
},
"date":
{
"type":"date",
"format":"YYYY-MM-DD'T'HH:mm:ss"
}
}
}
查询:
GET testindex4/_search
{
"size":0,
"aggs": {
"byHours": { ---> if you need doc count in distinct hours
"terms": {
"script": {
"source": "doc[params.date_field].value.hourOfDay;",
"params": {
"date_field": "date"
}
}
}
},
"distinct_hours": { ---> count of distinct hours
"cardinality": {
"script": {
"lang": "painless",
"source": "doc[params.date_field].value.hourOfDay;",
"params": {
"date_field": "date"
}
}
}
}
}
}
完整数据
"hits" : [
{
"_index" : "testindex4",
"_type" : "_doc",
"_id" : "ZjyHc2sB36IvcvW_wPNu",
"_score" : 1.0,
"_source" : {
"name" : "heart_beat",
"date" : "2019-06-05T12:10:00"
}
},
{
"_index" : "testindex4",
"_type" : "_doc",
"_id" : "ZzyIc2sB36IvcvW_DPMn",
"_score" : 1.0,
"_source" : {
"name" : "heart_beat",
"date" : "2019-06-05T12:15:00"
}
},
{
"_index" : "testindex4",
"_type" : "_doc",
"_id" : "ajyPc2sB36IvcvW_0fOc",
"_score" : 1.0,
"_source" : {
"name" : "heart_beat",
"date" : "2019-06-05T01:15:00"
}
}
]
结果:
"aggregations" : {
"distinct_hours" : {
"value" : 2
},
"byHours" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "12",
"doc_count" : 2
},
{
"key" : "1",
"doc_count" : 1
}
]
}
}
编辑:获取每台设备的记录 映射
PUT testindex4/_mapping
{
"properties": {
"device": {
"properties": {
"make": {
"type": "text"
},
"model":{
"type": "keyword"
}
}
},
"date": {
"type": "date",
"format": "yyyy-MM-dd HH:mm:ss"
}
}
}
查询
GET testindex4/_search
{
"size": 0,
"aggs": {
"byDevice": {
"terms": {
"field": "device.model"
},
"aggs": {
"byDate": {
"terms": {
"script": {
"source": "doc[params.date_field].value.toString('yyyy-MM-dd')",
"params": {
"date_field": "date"
}
}
},
"aggs": {
"byHours": {
"terms": {
"script": {
"source": "doc[params.date_field].value.getHour();",
"params": {
"date_field": "date"
}
}
}
}
}
}
}
}
}
}
结果
"aggregations" : {
"byDevice" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "VFD 720",
"doc_count" : 3,
"byDate" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "2019-06-06",
"doc_count" : 2,
"byHours" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "12",
"doc_count" : 1
},
{
"key" : "15",
"doc_count" : 1
}
]
}
},
{
"key" : "2019-06-05",
"doc_count" : 1,
"byHours" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "12",
"doc_count" : 1
}
]
}
}
]
}
},
{
"key" : "VFD 721",
"doc_count" : 2,
"byDate" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "2019-06-05",
"doc_count" : 1,
"byHours" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "12",
"doc_count" : 1
}
]
}
},
{
"key" : "2019-06-06",
"doc_count" : 1,
"byHours" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "12",
"doc_count" : 1
}
]
}
}
]
}
}
]
}
}
关于java - 从文档计算一天中的不同小时数，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/56679931/