Elasticsearch 子聚合

Question

通过以下查询，我得到了每块 15 分钟的最小值。我使用moving_fn 函数。现在我需要在前一个请求的 1 小时内获取每个块中的最大值。据我了解，它不能用于移动_fn 之后的聚合。你怎么能这样做？

这是我的查询：

GET logstash-2021.12.2*/_search 
{ 
  "query": { 
    "bool": { 
      "filter": [ 
        { 
          "range": { 
            "@timestamp": { 
              "gte": "now-24h" 
            } 
          } 
        }, 
        { 
          "bool": { 
            "should": [ 
              { 
                "match_phrase": { 
                  "company": "BLAH-BLAH" 
                } 
              }
            ] 
          } 
        } 
      ] 
    } 
  },
  "size": 0,
  "aggs": {
    "myDatehistogram": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "1m",
        "offset": "+30s"
      }, "aggs": {
        "the_count": {
          "moving_fn": {
            "buckets_path": "_count",
            "window": 15,
            "script": "MovingFunctions.min(values)"
          }
        }
      }
    }
   }
}

我的回答：

"aggregations" : {
    "myDatehistogram" : {
      "buckets" : [
        {
          "key_as_string" : "2021-12-25T05:58:30.000Z",
          "key" : 1640411910000,
          "doc_count" : 1196,
          "the_count" : {
            "value" : null
          }
        },
        {
          "key_as_string" : "2021-12-25T05:59:30.000Z",
          "key" : 1640411970000,
          "doc_count" : 1942,
          "the_count" : {
            "value" : 1196.0
          }
        },
        {
          "key_as_string" : "2021-12-25T06:00:30.000Z",
          "key" : 1640412030000,
          "doc_count" : 1802,
          "the_count" : {
            "value" : 1196.0
          }
        },
        {
          "key_as_string" : "2021-12-25T06:01:30.000Z",
          "key" : 1640412090000,
          "doc_count" : 1735,
          "the_count" : {
            "value" : 1196.0
          }
        },
        {
          "key_as_string" : "2021-12-25T06:02:30.000Z",
          "key" : 1640412150000,
          "doc_count" : 1699,
          "the_count" : {
            "value" : 1196.0
          }
        },
        {
          "key_as_string" : "2021-12-25T06:03:30.000Z",
          "key" : 1640412210000,
          "doc_count" : 1506,
          "the_count" : {
            "value" : 1196.0
          }
        }

从这个响应中，我需要得到每小时的最大值。提前谢谢你

Answer 1

只需添加第二个 agg：

"myDatehistogram": {
  "date_histogram": {
    "field": "@timestamp",
    "interval": "1m",
    "offset": "+30s"
  }, "aggs": {
    "min_15": {
      "moving_fn": {
        "buckets_path": "_count",
        "window": 15,
        "script": "MovingFunctions.min(values)"
      }
    }
    "max_60": {
      "moving_fn": {
        "buckets_path": "_count",
        "window": 60,
        "script": "MovingFunctions.max(values)"
      }
    }
  }
}