弹性搜索平均聚合答案

【问题标题】：Elastic search average aggregation弹性搜索平均聚合
【发布时间】：2018-01-29 17:12:06
【问题描述】：

这是我在 Kibana 中的代码示例：

get sample/_search
{
  "query": {
    "match_all": {}
  }
}

为了隐私起见，我已将 * 表示为 lat 和 lon，这些数字无论如何都不会产生任何变化。我收到的结果如下：

 {
  "took": 53,
  "timed_out": false,
  "num_reduce_phases": 3,
  "_shards": {
    "total": 1293,
    "successful": 1293,
    "skipped": 0,
    "failed": 0
      },
  "hits": {
    "total": 10937405,
    "max_score": 1,
    "hits": [
      {
        "_index": "sample_2016-08-08",
        "_type": "sample",
        "_id": "18-26-55-1470693602000",
        "_score": 1,
        "_source": {
          "type": "a",
          "company": 18,
          "value": 0,
          "equipment": 26,
          "state": "",
          "location": {
            "lat": *,
            "lon": *
          },
          "sensor": 55,
          "sampled_on": 1470693602000
        }
      },
      {
        "_index": "sample_2016-08-08",
        "_type": "sample",
        "_id": "18-26-56-1470693602000",
        "_score": 1,
        "_source": {
          "type": "a",
          "company": 18,
          "value": 7.436,
          "equipment": 26,
          "state": "",
          "location": {
            "lat": *,
            "lon": *
          },
          "sensor": 56,
          "sampled_on": 1470693602000
        }
      },
      {
        "_index": "sample_2016-08-08",
        "_type": "sample",
        "_id": "18-26-57-1470693602000",
        "_score": 1,
        "_source": {
          "type": "a",
          "company": 18,
          "value": 148.538,
          "equipment": 26,
          "state": "",
          "location": {
            "lat": *,
            "lon": *
          },
          "sensor": 57,
          "sampled_on": 1470693602000
        }
      },
      {
        "_index": "sample_2016-08-08",
        "_type": "sample",
        "_id": "18-26-59-1470693602000",
        "_score": 1,
        "_source": {
          "type": "a",
          "company": 18,
          "value": 0.196,
          "equipment": 26,
          "state": "",
          "location": {
            "lat": *,
            "lon": *
          },
          "sensor": 59,
          "sampled_on": 1470693602000
        }
      },
      {
        "_index": "sample_2016-08-08",
        "_type": "sample",
        "_id": "18-26-63-1470693708000",
        "_score": 1,
        "_source": {
          "type": "a",
          "company": 18,
          "value": 31.3,
          "equipment": 26,
          "state": "",
          "location": {
            "lat": *,
            "lon": *
          },
          "sensor": 63,
          "sampled_on": 1470693708000
        }
      },
      {
        "_index": "sample_2016-08-08",
        "_type": "sample",
        "_id": "18-26-65-1470693708000",
        "_score": 1,
        "_source": {
          "type": "a",
          "company": 18,
          "value": 25.6,
          "equipment": 26,
          "state": "",
          "location": {
            "lat": *,
            "lon": *
          },
          "sensor": 65,
          "sampled_on": 1470693708000
        }
      },
      {
        "_index": "sample_2016-08-08",
        "_type": "sample",
        "_id": "18-26-62-1470693708000",
        "_score": 1,
        "_source": {
          "type": "a",
          "company": 18,
          "value": 0.255,
          "equipment": 26,
          "state": "",
          "location": {
            "lat": *,
            "lon": *
          },
          "sensor": 62,
          "sampled_on": 1470693708000
        }
      },
      {
        "_index": "sample_2016-08-08",
        "_type": "sample",
        "_id": "18-26-63-1470693809000",
        "_score": 1,
        "_source": {
          "type": "a",
          "company": 18,
          "value": 31.3,
          "equipment": 26,
          "state": "",
          "location": {
            "lat": *,
            "lon": *
          },
          "sensor": 63,
          "sampled_on": 1470693809000
        }
      },
      {
        "_index": "sample_2016-08-08",
        "_type": "sample",
        "_id": "18-26-64-1470693809000",
        "_score": 1,
        "_source": {
          "type": "a",
          "company": 18,
          "value": 25.9,
          "equipment": 26,
          "state": "",
          "location": {
            "lat": *,
            "lon": *
          },
          "sensor": 64,
          "sampled_on": 1470693809000
        }
      },
      {
        "_index": "sample_2016-08-08",
        "_type": "sample",
        "_id": "18-26-65-1470693809000",
        "_score": 1,
        "_source": {
          "type": "a",
          "company": 18,
          "value": 25.6,
          "equipment": 26,
          "state": "",
          "location": {
            "lat": *,
            "lon": *
          },
          "sensor": 65,
          "sampled_on": 1470693809000
        }
      }
    ]
  }
}

“sampled_on”代表时间。每个“传感器”每隔几秒就会发送一个新的“值”。我想收到以下结果，我希望它出现在 1 个查询中：对于每个“传感器”，显示它从开始到现在每隔 30 分钟报告的平均“值”。这是一个例子：

传感器 1

最古老的
...
...
2009 年 1 月 14 日
下午 2:30 - 下午 3:00
平均值：5
...
2012 年 2 月 18 日
凌晨 3:10 - 凌晨 3:40
平均值：4
...
最新的

传感器 2

最古老的
...
...
2011 年 1 月 1 日
下午 5:30 - 下午 6:00
平均值：5
...
2012 年 2 月 3 日
早上 7:20 - 早上 7:50
平均值：4
...
最新的

感谢您的帮助！

【问题讨论】：

请显示到目前为止您尝试过的平均查询

标签： elasticsearch kibana

【解决方案1】：

这是我在 Kibana 中进行的示例查询，然后我剪切了请求。这意味着有些部分是不必要的，我不得不重命名一些字段，因为我在自己的记录中提出了类似的请求。

{
  "size": 0,
  "query": {
    "match_all": {}
  },
  "_source": {
    "excludes": []
  },
  "aggs": {
    "2": {
      "terms": {
        "field": "sensor",
        "size": 500,
        "order": {
          "1": "desc"
        }
      },
      "aggs": {
        "1": {
          "avg": {
            "field": "value"
          }
        }
      }
    }
  }
}

请注意，“aggs.2.terms.size”设置为 500，如果您有更多传感器，可能会截断一些结果。

【讨论】：