Multiple group by in Elasticsearch -


how write efficient es query below sql query?

select sum(visits) visits index group ip, port order visits desc limit 10

i using below es query, order visit inside port bucket. wan't top visits after grouping them destination ip , port.

"aggregations" : {     "ip":      {         "terms":          {             "field": "ip",             "size": 10         },         "aggregations":          {             "port":              {                 "terms":                  {                     "field": "port",                     "size": 0,                     "order":                      {                         "visits": "desc"                     }                 },                 "aggregations":                  {                     "visits":                      {                         "sum":                          {                             "field": "visits"                         }                     }                 }             }         }     } }

can 1 me this?

thanks.

data in elasticsearch 

 ip            port           visits      1.1.1.1        80             10     1.1.1.2        80             10      1.1.1.1        80             20     1.1.1.3        20             100      1.1.1.1        57             20     1.1.1.1        57             200

es response 

    1.1.1.1                      57             200              80             50     1.1.1.2                     80             10      1.1.1.3                      20             100

expected

1.1.1.1                  57             200 1.1.1.3                  20             100      1.1.1.1                         80             50 1.1.1.2                 80             10

what es is, first group ip , port, @ last sum visit , arrange visit desc inside port aggregator. not give top 10 visits rather give top 10 inside each port

solution:

use script merge 2 fields , apply group by

 {   "size": 0,   "aggs": {     "destination": {       "terms": {         "script": "doc['ip'].value +  ':'  + doc['port'].value", "order": {           "visits": "desc"         }       },                 "aggregations":                  {                     "visits":                      {                         "sum":                          {                             "field": "visits"                         }                      }                 }     }   } }

hope helpful.


Comments

Post a Comment

Popular posts from this blog

javascript - Using jquery append to add option values into a select element not working -

i'm looking dynamically populate select element names of items stored array. for reason it's not working , i'm not sure why. html: <div class="col-md-4 col-md-offset-4"> <select class="select1"> </select> , <select class="select2"> </select> </div> note i'm using bootstrap layout. here's jquery i'm using try , populate ".select1" jquery: select: function() { $.each(state.greens, function(index, value) { $(".select1").append("<option value =' " + index + " '>" + state.greens[index].name + "</option>"); }); } note function 'select' stored within object called 'display'. state.greens name of array i'm trying access. so @ end of html page call display.select(); call function. no error messages showing in console. also, saw question: appending
Read more

Android soft keyboard reverts to default keyboard on orientation change -

i'm building android soft keyboard , can't seem fix bug - have arabic , qwerty keyboard , when rotate device on qwerty keyboard (or arabic shift), it's if program has "restarted" , becomes arabic keyboard without shift. the onsaveinstancestate(bundle savedinstancestate) not work because application not extend activity inputmethodservice . i put following in android manifest android:configchanges="keyboard|keyboardhidden|orientation" android:windowsoftinputmode="stateunchanged|adjustresize"> i tried using @override public void onconfigurationchanged(configuration newconfig) { super.onconfigurationchanged(newconfig); log.i(mydebug, "config changed " + currentkeyboard.equals(qwerty)); } however, currentkeyboard.equals(qwerty)) results false , made sure true before orientation change. any appreciated. i think applications fault. if application restarting on orientation change
Read more

Rendering JButton to get the JCheckBox behavior in a JTable by using images does not update my table -

i rendering jbutton image on simulate jcheckbox behavior. why don't let jtable render jcheckbox? because need bigger checkboxes , there's no way can resize them (as far know). so, have own table cell renderer , editor. both renders jbutton , checkbox images on them. trying change image checked image unchecked image (or vice versa) , update cell value (boolean true or false). however, reason, getcelleditorvalue() not update table. so, release mouse, value goes original one. any appreciated! lot! public class tableexample extends jframe { jscrollpane pane; jpanel panel; jtable table; object[][] data; mytablemodel tm; renderer buttoncolumn; public tableexample(object[][] data) throws ioexception { string[] columns = {"column#1", "column#2", "column#3", "column#4", "column#5", "column#6"}; this.data = data; this.setpreferredsize(new dimension(700, 500));
Read more