es统计相关问题

Elasticsearch | 作者 hel2o | 发布于2019年02月14日 | 阅读数：1696

结构如下

{

  "mapping": {

    "usgtrafficlog": {

      "properties": {

        "closeReason": {

          "type": "keyword"

        },

        "destinationIp": {

          "type": "keyword"

        },

        "destinationPort": {

          "type": "long"

        },

        "protocol": {

          "type": "keyword"

        },

        "rcvBytes": {

          "type": "long"

        },

        "securityPolicyName": {

          "type": "keyword"

        },

        "sendBytes": {

          "type": "long"

        },

        "sourceIp": {

          "type": "keyword"

        },

        "sourceNATIp": {

          "type": "keyword"

        },

        "sourceNATPort": {

          "type": "long"

        },

        "sourcePort": {

          "type": "long"

        },

        "timestamp": {

          "type": "long"

        }

      }

    }

  }

}

我想统计出前10名的sourceIp对应的rcvBytes值的和在特定的timestamp内
请问有相关的DSL语句例子吗？感觉DSL超级难写！

3 个回复

rochy - rochy_he

赞同来自: elasticStack

{

    "size": 0,

    "query": {

        "bool": {

            "filter": [{

                "range": {

                    "timestamp": {

                        "from": 155013100000,

                        "to": 155013200000,

                        "include_lower": true,

                        "include_upper": true,

                        "boost": 1.0

                    }

                }

            }],

            "adjust_pure_negative": true,

            "boost": 1.0

        }

    },

    "aggregations": {

        "sourceIp": {

            "terms": {

                "field": "sourceIp",

                "size": 10,

                "min_doc_count": 1,

                "shard_min_doc_count": 0,

                "show_term_doc_count_error": false,

                "order": [{

                    "sum": "desc"

                }, {

                    "_key": "asc"

                }]

            },

            "aggregations": {

                "sum": {

                    "sum": {

                        "field": "rcvBytes"

                    }

                }

            }

        }

    }

}

hel2o

如果要rcvBytes和sendBytes的和要怎么写呢？

cl1321 - 85后IT女

求和的话，试下这个：

GET my_index/_search

{

  "script_fields": {

    "my_doubled_field": {

      "script": {

        "lang":   "expression",

        "source": "doc['rcvBytes'] + doc['sendBytes']"

      }

    }

  }

}

参考： How to use scripts

要回复问题请先登录或注册

es统计相关问题

3 个回复

发起人

相关问题

问题状态

es统计相关问题

与内容相关的链接

3 个回复

发起人

相关问题

问题状态