date_histogram +嵌套ES查询需要帮助

Question

我需要在时间戳上创建15m的桶，然后在每个时间戳中我需要每种类型的书的总和，当然还有书的总数。

例如，我的数据在 下面

[
{
"books":[
{
"id":0,
"count":10
},
{
"id":1,
"count":11
},
{
"id":2,
"count":7
},
{
"id":3,
"count":9
},
{
"id":4,
"count":16
}
],
"timestamp":1613693700000,
"total":53
},
{
"books":[
{
"id":0,
"count":0
},
{
"id":1,
"count":4
},
{
"id":2,
"count":9
},
{
"id":3,
"count":10
},
{
"id":4,
"count":1
}
],
"timestamp":1613694600000,
"total":24
}
]

我需要如下输出:

[
{
"timestamp":1613693700000,
"total_count":77,
"data":[
{
"id":0,
"count":10
},
{
"id":1,
"count":15
},
{
"id":2,
"count":16
},
{
"id":3,
"count":19
},
{
"id":4,
"count":17
}
]
}
]

我已经尝试了下面的查询，现在我被困在嵌套查询中，以获得每个时间戳桶中每种图书类型的总和。需要帮助。

{
"aggs": {
"count": {
"date_histogram": {
"field": "timestamp",
"interval": "15m"
},
"aggs": {
"total_count": {
"sum": {
"field": "total"
}
}
}
}
}
}

Answer 1

成功。在输出中不是完全相同的命名结构但它解决了问题

中的实际问题如果有人在同一条船上，就把它贴出来。

{
"aggs":{
"bucket_by_time":{
"date_histogram":{
"field":"timestamp",
"interval":"15m"
},
"aggs":{
"bucket_by_type":{
"nested":{
"path":"data"
},
"aggs":{
"books":{
"terms":{
"field":"data.id"
},
"aggs":{
"count":{
"sum":{
"field":"data.count"
}
}
}
},
"total_count":{
"sum_bucket":{
"buckets_path":"books>count"
}
}
}
}
}
}
}
}