zoukankan      html  css  js  c++  java
  • ELK 信息统计分析-2

    Range

    按数值类型的字段聚合统计

    {

    "query": {

    "match_all": {}

    },

    "aggs": {

    "terms_sc-status": {

    "range": {

    "field": "time-taken",

    "ranges": [

    {

    "key": "small",

    "to": 200

    },

    {

    "key": "medium",

    "from": 200,

    "to": 500

    },

    {

    "key": "large",

    "from": 500

    }

    ]

    },

    "aggs": {

    "avg_size": {

    "stats": {

    "field": "time-taken"

    }

    }

    }

    }

    },

    "size": 20

    }

       

       

    Date_range 对于时间类型的字段进行区段统计

    {

    "query": {

    "match_all": {}

    },

    "aggs": {

    "aggname": {

    "date_range": {

    "field": "@timestamp",

    "format": "yyyy-MM-dd",

    "ranges": [

    {

    "to":"now-2d" //统计范围:从最远点到当前日期的前2天

    },

    {

    "from":"now-2d" //统计范围:从当前日期的前2天到现在

    }

    ]

    },

    "aggs": {

    "avg_size": {

    "stats": {

    "field": "time-taken"

    }

    }

    }

    }

    },

    "size": 20

    }

       

       

       

    Histogram 对字段按间隔进行统计

       

    {

    "query": {

    "match_all": {}

    },

    "aggs": {

    "terms_sc-status": {

    "histogram": {

    "field": "time-taken",

    "interval": 5000,

    "min_doc_count": 1 //获取doc_count>=0数据

    },

    "aggs": {

    "avg_size": {

    "stats": {

    "field": "time-taken"

    }

    }

    }

    }

    },

    "size": 20

    }

       

       

       

    Date_histogram 对日期型字段统计,可以使用year(y)、month(M)、week(w)、day(d)、hour(h)、minute(m)等常量做作为interval属性的取值

       

       

    {

    "query": {

    "match_all": {}

    },

    "aggs": {

    "aggname": {

    "date_histogram": {

    "field": "@timestamp",

    "format": "yyyy-MM-dd",

    "interval": "1y", //间隔是1年,

    "keyed": true, // 返回值的key作为json对象的名称

    "min_doc_count": 1

    },

    "aggs": {

    "avg_size": {

    "stats": {

    "field": "time-taken"

    }

    }

    }

    }

    }

    }

       

       

       

       

  • 相关阅读:
    var与dynamic
    SQL Server占用服务器内存过高
    SQL SERVER 2012/ 2014 分页,用 OFFSET,FETCH NEXT改写ROW_NUMBER的用法
    SQL Server 2012 OFFSET/FETCH NEXT分页示例
    Solr初始化源码分析-Solr初始化与启动
    (c#) 销毁资源和释放内存
    C#中 ThreadStart和ParameterizedThreadStart区别
    MongoDB的C#封装类
    mongo DB for C#
    C#操作MongoDB
  • 原文地址:https://www.cnblogs.com/liuyuhua/p/5260702.html
Copyright © 2011-2022 走看看