首页 > 解决方案 > ElasticSearch:查询语法很痛苦

问题描述

我刚开始研究 ElasticSearch,用 Painless 写东西很痛苦。很难看到括号之间的连接,太多的空格。我正在研究异常值检测,例如,代码如下所示:

  "query": {
    "filtered": {
      "filter": {
        "range": {
          "hour": {
            "gte": "{{start}}",
            "lte": "{{end}}"
          }
        }
      }
    }
  },
  "size": 0,
  "aggs": {
    "metrics": {
      "terms": {
        "field": "metric",
        "size": 5
      },
      "aggs": {
        "queries": {
          "terms": {
            "field": "query",
            "size": 500
          },
          "aggs": {
            "series": {
              "date_histogram": {
                "field": "hour",
                "interval": "hour"
              },
              "aggs": {
                "avg": {
                  "avg": {
                    "field": "value"
                  }
                },
                "movavg": {
                  "moving_avg": {
                    "buckets_path": "avg",
                    "window": 24,
                    "model": "simple"
                  }
                },
                "surprise": {
                  "bucket_script": {
                    "buckets_path": {
                      "avg": "avg",
                      "movavg": "movavg"
                    },
                    "script": "(avg - movavg).abs()"
                  }
                }
              }
            },
            "largest_surprise": {
              "max_bucket": {
                "buckets_path": "series.surprise"
              }
            }
          }
        },
        "ninetieth_surprise": {
          "percentiles_bucket": {
            "buckets_path": "queries>largest_surprise",
            "percents": [
              90
            ]
          }
        }
      }
    }
  

我通过为代码创建自己的约定来解决它,以便它可读。它仅基于右括号,缩进有助于提高可读性。每当找到右括号组时,它就会打开一个新行(除了像“{{start}}”这样的内联组)它是这样的:

{
"query":{"filtered":{"filter":{"range":{"hour":{"gte":"{{start}}","lte":"{{end}}"}}}}},                                                                                 
"size":0,
"aggs":{"metrics":{"terms":{"field":"metric",“size”:5},
		    "aggs":{"queries":{"terms":{"field":"query","size":500},
				        "aggs":{"series": {"date_histogram":{"field":"hour","interval":"hour"},
						                     "aggs":{"avg":{"avg":{"field":"value"}},
                                                                      ....

我很想知道是否有任何其他有助于提高可读性和遵循代码行的约定。社区使用什么?

代码来自:https ://www.elastic.co/blog/implementing-a-statistical-anomaly-detector-part-1

标签: elasticsearchelasticsearch-painless

解决方案


推荐阅读