diff --git a/elastic search/elastic search.md b/elastic search/elastic search.md index 8000628..80c7f65 100644 --- a/elastic search/elastic search.md +++ b/elastic search/elastic search.md @@ -1273,4 +1273,227 @@ GET kibana_sample_data_ecommerce/_search > 基于es的分布式结构,`terms aggregations`在多个shards上运行时,document计数可能会有小的误差,`doc_count_error_upper_bound`的代表计数的最大可能误差 - sum_other_doc_count: 由于当前请求体中设置了`aggs.sales_by_category.terms.size`为5,故而`sum_other_doc_count`代表未包含在返回结果中的文档数量 -- \ No newline at end of file +- aggregations.buckets: 该字段代表category buckets数组,根据count来排序 + +#### date_histogram +`date_histogram`类型的聚合会将文档聚合为time-based buckets,其类似于terms,但是其并非基于精确匹配的聚合,而是基于日期的集合。 + +`date_histogram`聚合示例如下: +``` +GET kibana_sample_data_ecommerce/_search +{ + "size": 0, + "aggs": { + "daily_orders": { + "date_histogram": { + "field": "order_date", + "calendar_interval": "day", + "format": "yyyy-MM-dd", + "min_doc_count": 0 + } + } + } +} +``` +上述示例中,各参数含义如下: +- `min_doc_count`:当min_doc_count被设置为0时,会返回没有订单的天数 + +请求返回结果如下: +``` +{ + "took": 2, + "timed_out": false, + "_shards": { + "total": 5, + "successful": 5, + "skipped": 0, + "failed": 0 + }, + "hits": { + "total": { + "value": 4675, + "relation": "eq" + }, + "max_score": null, + "hits": [] + }, + "aggregations": { + "daily_orders": { + "buckets": [ + { + "key_as_string": "2024-11-28", + "key": 1732752000000, + "doc_count": 146 + }, + { + "key_as_string": "2024-11-29", + "key": 1732838400000, + "doc_count": 153 + }, + { + "key_as_string": "2024-11-30", + "key": 1732924800000, + "doc_count": 143 + }, + { + "key_as_string": "2024-12-01", + "key": 1733011200000, + "doc_count": 140 + }, + { + "key_as_string": "2024-12-02", + "key": 1733097600000, + "doc_count": 139 + }, + { + "key_as_string": "2024-12-03", + "key": 1733184000000, + "doc_count": 157 + }, + { + "key_as_string": "2024-12-04", + "key": 1733270400000, + "doc_count": 145 + }, + { + "key_as_string": "2024-12-05", + "key": 1733356800000, + "doc_count": 152 + }, + { + "key_as_string": "2024-12-06", + "key": 1733443200000, + "doc_count": 163 + }, + { + "key_as_string": "2024-12-07", + "key": 1733529600000, + "doc_count": 141 + }, + { + "key_as_string": "2024-12-08", + "key": 1733616000000, + "doc_count": 151 + }, + { + "key_as_string": "2024-12-09", + "key": 1733702400000, + "doc_count": 143 + }, + { + "key_as_string": "2024-12-10", + "key": 1733788800000, + "doc_count": 143 + }, + { + "key_as_string": "2024-12-11", + "key": 1733875200000, + "doc_count": 142 + }, + { + "key_as_string": "2024-12-12", + "key": 1733961600000, + "doc_count": 161 + }, + { + "key_as_string": "2024-12-13", + "key": 1734048000000, + "doc_count": 144 + }, + { + "key_as_string": "2024-12-14", + "key": 1734134400000, + "doc_count": 157 + }, + { + "key_as_string": "2024-12-15", + "key": 1734220800000, + "doc_count": 158 + }, + { + "key_as_string": "2024-12-16", + "key": 1734307200000, + "doc_count": 144 + }, + { + "key_as_string": "2024-12-17", + "key": 1734393600000, + "doc_count": 151 + }, + { + "key_as_string": "2024-12-18", + "key": 1734480000000, + "doc_count": 145 + }, + { + "key_as_string": "2024-12-19", + "key": 1734566400000, + "doc_count": 157 + }, + { + "key_as_string": "2024-12-20", + "key": 1734652800000, + "doc_count": 158 + }, + { + "key_as_string": "2024-12-21", + "key": 1734739200000, + "doc_count": 153 + }, + { + "key_as_string": "2024-12-22", + "key": 1734825600000, + "doc_count": 165 + }, + { + "key_as_string": "2024-12-23", + "key": 1734912000000, + "doc_count": 153 + }, + { + "key_as_string": "2024-12-24", + "key": 1734998400000, + "doc_count": 158 + }, + { + "key_as_string": "2024-12-25", + "key": 1735084800000, + "doc_count": 160 + }, + { + "key_as_string": "2024-12-26", + "key": 1735171200000, + "doc_count": 159 + }, + { + "key_as_string": "2024-12-27", + "key": 1735257600000, + "doc_count": 152 + }, + { + "key_as_string": "2024-12-28", + "key": 1735344000000, + "doc_count": 142 + } + ] + } + } +} +``` +上述示例中,`key_as_string`为`human readable`日期字符串,而`key`则是和`key_as_string`代表相同日期的unix时间戳。 + +`doc_count`代表bucket中的文档个数。 + +##### Calendar intervals +`calendar-aware interval`可以通过`calendar_interval`来进行配置,可以通过时间单位名称`month`或单个时间单位`1M`来进行指定。类似的`day`和`1d`也是等同的,`但是,并不支持2d这种多个时间单位的配置`。 + +可以接受的时间单位为: +- `minute, 1m` +- `hour, 1h` +- `day, 1d` +- `week, 1w` +- `month, 1M` +- `quarter, 1q` +- `year, 1y` + +#### \ No newline at end of file