Elasticsearch 统计代码例子

aggs

avg 平均数

最近15分钟的平均访问时间，upstream_time_ms是每次访问时间，单位毫秒

{
  "query": {
    "filtered": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-15m",
            "lt": "now"
          }
        }
      }
    }
  },
  "aggs": {
    "execute_time": {
      "avg": {
        "field": "upstream_time_ms"
      }
    }
  }
}
//当然你也可以直接将过滤器写在aggs里面
{
  "size": 0,
  "aggs": {
    "filtered_aggs": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-15m",
            "lt": "now"
          }
        }
      },
      "aggs": {
        "execute_time": {
          "avg": {
            "field": "upstream_time_ms"
          }
        }
      }
    }
  }
}

cardinality 基数，比如计算uv

你可能注意到了size:0，如果你只需要统计数据，不要数据本身，就设置它，这不是我投机取巧，官方文档也是这么干的。

{
  "size": 0,
  "aggs": {
    "filtered_aggs": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-15m",
            "lt": "now"
          }
        }
      },
      "aggs": {
        "ipv": {
          "cardinality": {
            "field": "ip"
          }
        }
      }
    }
  }
}

percentiles 基于百分比统计

最近15分钟，99.9的请求的执行时间不超过多少

{
  "size": 0,
  "query": {
    "filtered": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-15m",
            "lt": "now"
          }
        }
      }
    }
  },
  "aggs": {
    "execute_time": {
      "percentiles": {
        "field": "upstream_time_ms",
        "percents": [
          90,
          95,
          99.9
        ]
      }
    }
  }
}

//返回值，0.1%的请求超过了159ms
{
  "took": 620,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 679400,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "execute_time": {
      "values": {
        "90.0": 24.727003484320534,
        "95.0": 72.6200981699678,
        "99.9": 159.01065773524886 //99.9的数据落在159以内，是系统计算出来159
      }
    }
  }
}

percentile_ranks 指定一个范围，有多少数据落在这里

{
  "size": 0,
  "query": {
    "filtered": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-15m",
            "lt": "now"
          }
        }
      }
    }
  },
  "aggs": {
    "execute_time": {
      "percentile_ranks": {
        "field": "upstream_time_ms",
        "values": [
          50,
          160
        ]
      }
    }
  }
}

//返回值

{
  "took": 666,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 681014,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "execute_time": {
      "values": {
        "50.0": 94.14716385885366,
        "160.0": 99.91130872493076 //99.9的数据落在了160以内，这次，160是我指定的，系统计算出99.9
      }
    }
  }
}

统计最近15分钟，不同的链接请求时间大小

{
  "size": 0,
  "query": {
    "filtered": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-15m",
            "lt": "now"
          }
        }
      }
    }
  },
  "aggs": {
    "execute_time": {
      "terms": {
        "field": "uri"
      },
      "aggs": {
        "avg_time": {
          "avg": {
            "field": "upstream_time_ms"
          }
        }
      }
    }
  }
}

//返回,看起来url1 比 url2慢一点(avg_time)，不过url1的请求量比较大 （doc_count）
{
  "took": 1655,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 710802,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "execute_time": {
      "doc_count_error_upper_bound": 10,
      "sum_other_doc_count": 347175,
      "buckets": [
        {
          "key": "/url1",
          "doc_count": 362688,
          "avg_time": {
            "value": 6.601660380271749
          }
        },
        {
          "key": "/url2",
          "doc_count": 939,
          "avg_time": {
            "value": 5.313099041533547
          }
        }
      ]
    }
  }
}

找出url响应最慢的前2名

{
  "size": 0,
  "query": {
    "filtered": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-15m",
            "lt": "now"
          }
        }
      }
    }
  },
  "aggs": {
    "execute_time": {
      "terms": {
        "size": 2,
        "field": "uri",
        "order": {
          "avg_time": "desc"
        }
      },
      "aggs": {
        "avg_time": {
          "avg": {
            "field": "upstream_time_ms"
          }
        }
      }
    }
  }
}
//返回值
{
  "took": 1622,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 748712,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "execute_time": {
      "doc_count_error_upper_bound": -1,
      "sum_other_doc_count": 748710,
      "buckets": [
        {
          "key": "url_shit",
          "doc_count": 123,
          "avg_time": {
            "value": 8884
          }
        },
        {
          "key": "url_shit2",
          "doc_count": 456,
          "avg_time": {
            "value": 8588
          }
        }
      ]
    }
  }
}

value_count 文档数量

相当于
select count(*) from table group by uri，为了达到这个目的，只需要把上文中,avg 换成value_count。不过avg的时候，结果中的doc_count其实达到了同样效果。

怎么取数据画个图？比如：最近2分钟，每20秒的时间窗口中，平均响应时间是多少

{
  "size": 0,
  "query": {
    "filtered": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-2m",
            "lt": "now"
          }
        }
      }
    }
  },
  "aggs": {
    "execute_time": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "20s"
      },
      "aggs": {
        "avg_time": {
          "avg": {
            "field": "upstream_time_ms"
          }
        }
      }
    }
  }
}

pv 分时统计图（每小时一统计）

周期大小对性能影响不大

{
  "size":0,
  "fields":false,
  "aggs": {
    "execute_time": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "1h"
      }
    }
  }
}