Elasticsearch api - @timestamp 的订单聚合

Question

在我的索引中，我有很多不同结构的文档。所有文档之间的共享密钥如下：(Store,owner,products,timestamp)

{"Store":"books for school","owner":"user_15","products":40,"@timestamp":2020/08/02T18:00, "a1":1,"a2":...}
{"Store":"books for school","owner":"user_15","products":45,"@timestamp":2020/08/02T19:00,"b1":1...}
{"Store":"books for school","owner":"user_17","products":55,"@timestamp":2020/08/02T20:00, "b2":1....}

在我的应用程序中，我试图获取每个商店（所有者、产品）的最新共享密钥。所以对于这个示例，我想获取示例中的最后一个文档。

我尝试对所有共享键创建一个聚合查询，但我不确定如何按日期对内部结果进行排序（以便最新的值排在第一位）：

{
  "size": 0,
  "aggs": {
    "store_aggr": {
      "terms": {
        "field": "Store"
      },
      "aggs": {
        "owner_aggr": {
          "terms": {
            "field": "owner"
          }
          }
          ,
            "products_aggr": {
              "terms": {
                "field": "products"
              }
            }
                
        }
      }
    }
  
}

如何按@timestamp 对查询的内部存储桶进行排序？这样我就可以取第一个值，它肯定是最新的..

此外，如何过滤数据以使文档来自最近两天？我需要在@timestamp 字段上添加查询过滤器吗？

Answer 1

是的，您需要range 查询才能仅选择过去两天。至于排序——您可以使用有序的top_hits agg 来检索底层文档：

{
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-2d"
      }
    }
  }, 
  "size": 0,
  "aggs": {
    "store_aggr": {
      "terms": {
        "field": "Store"
      },
      "aggs": {
        "owner_aggr": {
          "terms": {
            "field": "owner"
          },
          "aggs": {
            "top_hits_aggr": {
              "top_hits": {
                "sort": {
                  "@timestamp": {
                    "order": "desc"
                  }
                }
              }
            }
          }
        },
        "products_aggr": {
          "terms": {
            "field": "products"
          },
          "aggs": {
            "top_hits_aggr": {
              "top_hits": {
                "sort": {
                  "@timestamp": {
                    "order": "desc"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}