elasticsearch——嵌套聚合（日志分析）

1.十月每天各用户访问量

{ "size": 0, "query": { "match_all":{} }, "aggs": { "group_time": { "date_histogram": { "field": "time", "interval": "1d", "time_zone": "+00:00", "format": "yyyy-MM-dd", "min_doc_count": 0 }, "aggs": { "group_by_user_id": { "terms": { "field": "user_id.keyword", "size": 1 } } } } } }

2.十月每天有多少用户访问

{ "size": 0, "query": { "match_all":{} }, "aggs": { "group_time": { "date_histogram": { "field": "time", "interval": "1d", "time_zone": "+00:00", "format": "yyyy-MM-dd", "min_doc_count": 0 }, "aggs": { "count": { "cardinality": { "field": "user_id.keyword" } } } } } }

3.每分钟求和数据量

{ "size": 0, "query": { "match_all":{} }, "aggs": { "group_time": { "date_histogram": { "field": "time", "interval": "1m", "time_zone": "+08:00", "format": "yyyy-MM-dd hh:mm", "min_doc_count": 1 }, "aggs": { "sum_every_min": { "sum": { "field": "count" } }, "r_bucket_sort": { "bucket_sort": { "sort": { "sum_every_min": { "order": "desc" } }, "from": 0, "size": 10 } } } } } }