elasticsearch - 每天与前一天的计数的 Delta (Difference)

问题描述

我是 ELK Stack 的新手。我正在使用 Kibana 仪表板来查找每天与前一天的计数差异（差异）。所以，我们可以知道每天的销售额与前一天相比增加了多少

供参考：Present Dashboard 写了一个查询来查找每个日期的计数以及与版本号聚合的存储桶。

我的查询：

{
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "install_date",
        "interval": "1d",
        "time_zone": "America/New_York",
        "min_doc_count": 1
      },
      "aggs": {
        "3": {
          "terms": {
            "field": "version.keyword",
            "size": 50,
            "order": {
              "_key": "desc"
            },
            "script": "( _value.indexOf('-') > 0 ? _value.substring(0, _value.indexOf('-')+2) : _value )"
          },
          "aggs": {
            "1": {
              "sum_bucket": {
                "buckets_path": "1-bucket>_count"
              }
            },
            "1-bucket": {
              "date_histogram": {
                "field": "install_date",
                "interval": "1d",
                "time_zone": "America/New_York",
                "min_doc_count": 1
              }
            }
          }
        }
      }
    }
  },
  "size": 0,
  "_source": {
    "excludes": []
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "deploy_date_asset_tag",
      "format": "date_time"
    },
    {
      "field": "deploy_date_localtime",
      "format": "date_time"
    },
    {
      "field": "install_date",
      "format": "date_time"
    },
    {
      "field": "timestamp",
      "format": "date_time"
    },
    {
      "field": "ui_legacy_access",
      "format": "date_time"
    },
    {
      "field": "ui_satori_access",
      "format": "date_time"
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match_all": {}
        },
        {
          "match_all": {}
        },
        {
          "range": {
            "timestamp": {
              "gte": 1408458089497,
              "lte": 1566224489497,
              "format": "epoch_millis"
            }
          }
        }
      ],
      "filter": [],
      "should": [],
      "must_not": []
    }
  }
}

标签： elasticsearchkibanaelk

elasticsearch - 每天与前一天的计数的 Delta (Difference)

问题描述

解决方案

推荐阅读