elasticsearch - 日期汇总-ElasticSearch

Question

我最近开始从事Elasticsearch的工作，但在按日期进行聚合时却遇到了一个问题。

对应:

{
  "posts": {
    "mappings": {
        "facebook": {
            "properties": {
                "post_created_time": {
                    "type": "date"
                },
                "post_description": {
                    "type": "text"
                },
                "post_image": {
                    "type": "text"
                }
            }
        }
    }
  }
}

资源:

"hits": [
        {
            "_index": "posts",
            "_type": "facebook",
            "_id": "1027753751227740806",
            "_score": 1,
            "_source": {
                "post_created_time": 1436737816,
                "post_description": "captain's log: sailed a sea of booze after sundown with a new crew. bonds cemented. four more days of r&r before the next voyage. july the 5th, 2015 #captainslog #litely",
                "post_image": "https://scontent.cdninstagram.com/t51.2885-15/s640x640/sh0.08/e35/11419297_845398318885282_1471458983_n.jpg?ig_cache_key=MTAyNzc1Mzc1MTIyNzc0MDgwNg%3D%3D.2"
            }
        },
        {
            "_index": "posts",
            "_type": "facebook",
            "_id": "1030858912926085173",
            "_score": 1,
            "_source": {
                "post_created_time": 1436218427,
                "post_description": "wanna go for a ride? #?",
                "post_image": "https://scontent.cdninstagram.com/t51.2885-15/s640x640/sh0.08/e35/1739201_510171422480872_883567488_n.jpg?ig_cache_key=MTAzMDg1ODkxMjkyNjA4NTE3Mw%3D%3D.2"
            }
        }
]

我尝试过的查询:

{  
 "size":0,
 "aggs":{  
     "metrics_by_day":{  
     "date_histogram":{  
        "field":"post_created_time",
        "interval":"day"
     }
   }
 }
}

以上查询的输出:

"aggregations": {
    "metrics_by_day": {
        "buckets": [
            {
                "key_as_string": "1970-01-17",
                "key": 1382400000,
                "doc_count": 2
            }
        ]
    }
}

预期输出为:

"aggregations": {
    "metrics_by_day": {
        "buckets": [
            {
                "key_as_string": "2015-07-12",
                "doc_count": 1
            },
            {
                "key_as_string": "2015-07-06",
                "doc_count": 1
            }
        ]
    }
}

任何建议将不胜感激

Answer 1

映射和汇总中的日期格式存在问题。日期类型的格式为"format" : "epoch_second"(https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html)，并且必须指定DateHistogramm聚合"format" : "yyyy-MM-dd"(https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-datehistogram-aggregation.html)的日期格式

这是更正的映射:

{
"posts": {
    "mappings": {
        "facebook": {
            "properties": {
                "post_created_time": {
                    "type": "date",
                     "format":"epoch_second"
                },
                "post_description": {
                    "type": "text"
                },
                "post_image": {
                    "type": "text"
                }
            }
        }
    }
  }
}

和您的汇总:

{  
 "size":0,
 "aggs":{  
     "metrics_by_day":{  
     "date_histogram":{  
        "field":"post_created_time",
        "interval":"day",
        "format" : "yyyy-MM-dd"
     }
   }
 }
}