Elasticsearch 統計代碼例子

aggs

avg 平均數

最近15分鍾的平均訪問時間，upstream_time_ms是每次訪問時間，單位毫秒

{
  "query": {
    "filtered": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-15m",
            "lt": "now"
          }
        }
      }
    }
  },
  "aggs": {
    "execute_time": {
      "avg": {
        "field": "upstream_time_ms"
      }
    }
  }
}
//當然你也可以直接將過濾器寫在aggs里面
{
  "size": 0,
  "aggs": {
    "filtered_aggs": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-15m",
            "lt": "now"
          }
        }
      },
      "aggs": {
        "execute_time": {
          "avg": {
            "field": "upstream_time_ms"
          }
        }
      }
    }
  }
}

cardinality 基數，比如計算uv

你可能注意到了size:0，如果你只需要統計數據，不要數據本身，就設置它，這不是我投機取巧，官方文檔也是這么干的。

{
  "size": 0,
  "aggs": {
    "filtered_aggs": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-15m",
            "lt": "now"
          }
        }
      },
      "aggs": {
        "ipv": {
          "cardinality": {
            "field": "ip"
          }
        }
      }
    }
  }
}

percentiles 基於百分比統計

最近15分鍾，99.9的請求的執行時間不超過多少

{
  "size": 0,
  "query": {
    "filtered": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-15m",
            "lt": "now"
          }
        }
      }
    }
  },
  "aggs": {
    "execute_time": {
      "percentiles": {
        "field": "upstream_time_ms",
        "percents": [
          90,
          95,
          99.9
        ]
      }
    }
  }
}

//返回值，0.1%的請求超過了159ms
{
  "took": 620,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 679400,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "execute_time": {
      "values": {
        "90.0": 24.727003484320534,
        "95.0": 72.6200981699678,
        "99.9": 159.01065773524886 //99.9的數據落在159以內，是系統計算出來159
      }
    }
  }
}

percentile_ranks 指定一個范圍，有多少數據落在這里

{
  "size": 0,
  "query": {
    "filtered": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-15m",
            "lt": "now"
          }
        }
      }
    }
  },
  "aggs": {
    "execute_time": {
      "percentile_ranks": {
        "field": "upstream_time_ms",
        "values": [
          50,
          160
        ]
      }
    }
  }
}

//返回值

{
  "took": 666,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 681014,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "execute_time": {
      "values": {
        "50.0": 94.14716385885366,
        "160.0": 99.91130872493076 //99.9的數據落在了160以內，這次，160是我指定的，系統計算出99.9
      }
    }
  }
}

統計最近15分鍾，不同的鏈接請求時間大小

{
  "size": 0,
  "query": {
    "filtered": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-15m",
            "lt": "now"
          }
        }
      }
    }
  },
  "aggs": {
    "execute_time": {
      "terms": {
        "field": "uri"
      },
      "aggs": {
        "avg_time": {
          "avg": {
            "field": "upstream_time_ms"
          }
        }
      }
    }
  }
}

//返回,看起來url1 比 url2慢一點(avg_time)，不過url1的請求量比較大 （doc_count）
{
  "took": 1655,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 710802,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "execute_time": {
      "doc_count_error_upper_bound": 10,
      "sum_other_doc_count": 347175,
      "buckets": [
        {
          "key": "/url1",
          "doc_count": 362688,
          "avg_time": {
            "value": 6.601660380271749
          }
        },
        {
          "key": "/url2",
          "doc_count": 939,
          "avg_time": {
            "value": 5.313099041533547
          }
        }
      ]
    }
  }
}

找出url響應最慢的前2名

{
  "size": 0,
  "query": {
    "filtered": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-15m",
            "lt": "now"
          }
        }
      }
    }
  },
  "aggs": {
    "execute_time": {
      "terms": {
        "size": 2,
        "field": "uri",
        "order": {
          "avg_time": "desc"
        }
      },
      "aggs": {
        "avg_time": {
          "avg": {
            "field": "upstream_time_ms"
          }
        }
      }
    }
  }
}
//返回值
{
  "took": 1622,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 748712,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "execute_time": {
      "doc_count_error_upper_bound": -1,
      "sum_other_doc_count": 748710,
      "buckets": [
        {
          "key": "url_shit",
          "doc_count": 123,
          "avg_time": {
            "value": 8884
          }
        },
        {
          "key": "url_shit2",
          "doc_count": 456,
          "avg_time": {
            "value": 8588
          }
        }
      ]
    }
  }
}

value_count 文檔數量

相當於
select count(*) from table group by uri，為了達到這個目的，只需要把上文中,avg 換成value_count。不過avg的時候，結果中的doc_count其實達到了同樣效果。

怎么取數據畫個圖？比如：最近2分鍾，每20秒的時間窗口中，平均響應時間是多少

{
  "size": 0,
  "query": {
    "filtered": {
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-2m",
            "lt": "now"
          }
        }
      }
    }
  },
  "aggs": {
    "execute_time": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "20s"
      },
      "aggs": {
        "avg_time": {
          "avg": {
            "field": "upstream_time_ms"
          }
        }
      }
    }
  }
}

pv 分時統計圖（每小時一統計）

周期大小對性能影響不大

{
  "size":0,
  "fields":false,
  "aggs": {
    "execute_time": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "1h"
      }
    }
  }
}