Elasticsearch查询aggs排序最大日期

Question

我有这样的数据:

Id ,,, GroupId ,,,UpdateDate
1,,,, 1,,,,,,,,,,,,,,,, 2013 - 11 - 15 t12:00:00
2,,,, 1,,,,,,,,,,,,,,,, 2013 - 11 - 20 t12:00:00
3,,,, 2,,,,,,,,,,,,,,,, 2013 - 12 - 01 t12:00:00
4,,,, 2,,,,,,,,,,,,,,,, 2013 - 13 - 01 t12:00:00
5,,,, 2,,,,,,,,,,,,,,,, 2013 - 11 - 01 t12:00:00
6,,,, 3,,,,,,,,,,,,,,,, 2013 - 10 - 01 t12:00:00

我怎么能写一个查询返回列表过滤/分组到最大UpdateDate foreach组?最后的列表按UpdateDate排序。

我期望这样的输出:

Id ,,, GroupId ,,,UpdateDate
4,,,, 2,,,,,,,,,,,,,,,, 2013 - 13 - 01 t12:00:00
2,,,, 1,,,,,,,,,,,,,,,, 2013 - 11 - 20 t12:00:00
6,,,, 3,,,,,,,,,,,,,,,, 2013 - 10 - 01 t12:00:00

谢谢你

Answer 1

是的，使用elasticsearch是可能的，但是数据将是JSON格式，需要按照上面显示的格式进行平面化。下面是我如何使用Marvel Sense

散装装载数据:

POST myindex/mytype/_bulk
{"index":{}}
{"id":1,"GroupId":1,"UpdateDate":"2013-11-15T12:00:00"}
{"index":{}}
{"id":2,"GroupId":1,"UpdateDate":"2013-11-20T12:00:00"}
{"index":{}}
{"id":3,"GroupId":2,"UpdateDate":"2013-12-01T12:00:00"}
{"index":{}}
{"id":4,"GroupId":2,"UpdateDate":"2013-12-01T12:00:00"}
{"index":{}}
{"id":5,"GroupId":2,"UpdateDate":"2013-11-01T12:00:00"}
{"index":{}}
{"id":6,"GroupId":3,"UpdateDate":"2013-10-01T12:00:00"}

GET max by group:

GET myindex/mytype/_search?search_type=count
{
  "aggs": {
    "NAME": {
      "terms": {
        "field": "GroupId"
      },
      "aggs": {
        "NAME": {
          "max": {
            "field": "UpdateDate"
          }
        }
     }
    }
  }
}

输出:

{
...
   "aggregations": {
      "NAME": {
         "buckets": [
            {
               "key": 2,
               "doc_count": 3,
               "NAME": {
                 "value": 1385899200000
              }
           },
            {
               "key": 1,
               "doc_count": 2,
               "NAME": {
                  "value": 1384948800000
               }
            },
            {
               "key": 3,
               "doc_count": 1,
               "NAME": {
                  "value": 1380628800000
               }
            }
         ]
      }
   }
...
}

最大日期返回为Linux时间，需要转换回可读的日期格式。