你的浏览器禁用了JavaScript, 请开启后刷新浏览器获得更好的体验!
输入关键字进行搜索
搜索:
没有找到相关结果
doom
赞同来自:
[b]可以使用aggs内 rang分组, [/b]
基本数据: comm |deptno |empno|ename | hiredate | job | mgr | sal ------+-------+-----+-------+------------------------+---------+-----+----- 500 |30 |7521 |WARD |1981-02-22T00:00:00.000Z|SALESMAN |7698 |1250 300 |30 |7499 |ALLEN |1981-02-20T00:00:00.000Z|SALESMAN |7698 |1600 0 |20 |7369 |SMITH |1980-12-17T00:00:00.000Z|CLERK |7902 |800 1400 |30 |7654 |MARTIN |1981-09-28T00:00:00.000Z|SALESMAN |7698 |1250 0 |20 |7566 |JONES |1981-04-02T00:00:00.000Z|MANAGER |7839 |2975 0 |30 |7900 |JAMES |1981-12-03T00:00:00.000Z|CLERK |7698 |950 0 |30 |7698 |BLAKE |1981-05-01T00:00:00.000Z|MANAGER |7839 |2850 0 |30 |7844 |TURNER |1981-09-08T00:00:00.000Z|SALESMAN |7698 |1500 0 |10 |7934 |MILLER |1982-01-23T00:00:00.000Z|CLERK |7782 |1300 0 |10 |7782 |CLARK |1981-06-09T00:00:00.000Z|MANAGER |7839 |2450 0 |20 |7876 |ADAMS |1987-05-23T00:00:00.000Z|CLERK |7788 |1100 0 |20 |7788 |SCOTT |1987-04-19T00:00:00.000Z|ANALYST |7566 |3000 0 |10 |7839 |KING |1981-11-17T00:00:00.000Z|PRESIDENT|0 |5000 0 |20 |7902 |FORD |1981-12-03T00:00:00.000Z|ANALYST |7566 |300
GET /emp/_search { "size": 0, "aggs": { "by3day": { "range": { "field": "hiredate", "ranges": [ { "from": "1980-01-01", "to": "1981-01-01" }, { "from": "1981-01-01", "to": "1982-01-01" }, { "from": "1982-01-01", "to": "1983-01-01" } ] }, "aggs": { "top_users": { "top_hits": { "size": 100, "sort": [ { "sal": { "order": "desc" } } ] } } } } } }
"date_range": { "field": "", "ranges": [ { "from": "now-10d/d", "to": "now" } ] }
要回复问题请先登录或注册
1 个回复
doom
赞同来自:
按照年份分组,对每个分组取前100员工的薪水按照逆向排序;
聚合分组后的是只有分组的key和文档数量,没有源文档,好像没有直接取数据的函数,就取前100,然后排序;
你需要的是三天;可以参照