elasticsearch - 多字可视化

Question

我正在尝试以某种方式可视化kibana，以便绘制图表，其中哪些客户向购物车中添加了商品，哪些客户从购物车中删除了东西。我正在从错误日志中获取此数据。

这是数据的json示例

{
  "_index": "filebeat-2016.03.08",
  "_type": "php-error",
  "_id": "AVNUOptErt39_iTb3Riw",
  "_score": null,
  "_source": {
    "message": "[Mon Mar 07 20:15:35.571673 2016] [:error] [pid 13829] [client 24.220.167.100:56888] {\"email\":null,\"name\":\" \",\"message\":\"remove from cart\",\"remaining_cart_items\":\"{\\\\\"total\\\\\":\\\\\"1 item(s) - $16.26\\\\\"}\"}, referer: https://exsite.com/",
    "@version": "1",
    "@timestamp": "2016-03-08T03:15:36.786Z",
    "beat": {
      "hostname": "ip-110-0-0-154",
      "name": "ip-110-0-0-154"
    },
    "count": 1,
    "fields": null,
    "input_type": "log",
    "source": "/var/log/apache2/error.log",
    "type": "log_format_error",
    "host": "ip-10-0-0-154"
  },
  "fields": {
    "@timestamp": [
      1457406936786
    ]
  },
  "sort": [
    1457406936786
  ]
}

您会看到有一个“从购物车中删除”，我可以用它来搜索dicover，然后从中创建视觉效果。这是添加到购物车数据

{
  "_index": "filebeat-2016.03.08",
  "_type": "php-error",
  "_id": "AVNUOhKOrt39_iTb3Riv",
  "_score": null,
  "_source": {
    "message": "[Mon Mar 07 20:14:56.377612 2016] [:error] [pid 13839] [client 24.220.167.100:56882] {\"email\":null,\"name\":\" \",\"message\":\"Added to cart\",\"add_to_cart\":\"{\\\\\"success\\\\\":\\\\\"Success: You have added <a href=\\\\\\\\\\\\\"https:\\\\\\\\\\\\/\\\\\\\\\\\\/site.com\\\\\\\\\\\\/whitesting\\\\\\\\\\\\\">My Test<\\\\\\\\\\\\/a> to your <a href=\\\\\\\\\\\\\"https:\\\\\\\\\\\\/\\\\\\\\\\\\/site.com\\\\\\\\\\\\/index.php?route=checkout\\\\\\\\\\\\/cart\\\\\\\\\\\\\">shopping cart<\\\\\\\\\\\\/a>!\\\\\",\\\\\"total\\\\\":\\\\\"2 item(s) - $32.51\\\\\"}\"}, referer: https://exsite.com/dtesting",
    "@version": "1",
    "@timestamp": "2016-03-08T03:15:01.767Z",
    "beat": {
      "hostname": "ip-110-0-0-154",
      "name": "ip-110-0-0-154"
    },
    "count": 1,
    "fields": null,
    "input_type": "log",
    "source": "/var/log/apache2/error.log",
    "type": "log_format_error",
    "host": "ip-10-0-0-154"
  },
  "fields": {
    "@timestamp": [
      1457406901767
    ]
  } 
}

所以现在我该如何绘制这些数据了，在这里我可以看到有多少个移除计数以及有多少个添加到购物车。

我发现中的查询是

"remove from cart" OR "Added to cart"

谢谢

Answer 1

理想情况下，您将使用logstash之类的内容来解析日志行，因此不必像您一样诉诸查询，但是如果必须，则始终可以使用过滤器聚合。

在构建可视化时(假设您使用的是条形图)，您将创建以下汇总以可视化此数据:

对每个存储桶中的文档进行计数的度量标准(默认情况下存在)

x轴的存储桶，它是时间字段中的日期直方图

一个使用过滤器聚合将条分割的存储桶。然后为这个agg提供两个过滤器，一个带有“从购物车中删除”，另一个带有“添加到购物车”的过滤器