The requested URL was not found on this server. 不管你信不信,反正我是没找到

如何在kibana的可视化中展示bucket_script聚合的结果

Kibana | 作者 Marine | 发布于2020年04月02日 | 阅读数:5219

软件版本:
ElasticSearch 和 Kibana版本均为 7.3.2;
 
背景描述:
有一系列的机票订单数据存储在索引flight中;每一个订单都包含一个提前预订天数order_days,如果order_days>=3则为一个符合政策的订单,否则就是一个不符合政策的订单;每一个订单都从属于一个部门 ticket_dept; 
 
统计要求:
需要统计每个部门的订单符合符合政策数与该部门订单数的百分比,然后按百分比从高到低排列,取top10;
 
聚合脚本:
GET flights/_search
{
"size": 0,

"aggs": {
"depart_bucket": {
"terms": {
"field": "ticket_dept.keyword",
"size": 10,
"order": {
"match_percent": "desc"
}
},
"aggs": {
"match_policy" : {
"filter": {
"range": {
"order_days": {
"gte": 3
}
}
}
},
"match_percent": {
"bucket_script": {
"buckets_path": {
"totalCount": "_count",
"matchCount": "match_policy._count"
},
"script": "params.matchCount / params.totalCount * 100.0"
}
}
}
}
}
}

问题描述:
1)同样功能如何在kibana的可视化中实现?(我在kibana的可视化中没找到bucket_script的内容)
2)bucket 的排序为什么不能使用 pipeline 聚合结果?要怎样才能正常使用呢?(如示例中使用了 match_percent 进行排序,使用的时候是会报错的:Invalid aggregator order path [match_percent]. The provided aggregation [match_percent] either does not exist, or is a pipeline aggregation and cannot be used to sort the buckets.)
已邀请:

Marine

赞同来自: rudylhm

贴上Vega可视化组件的展示代码(按航线选择折扣<50%的比例):
 
{
"$schema": "https://vega.github.io/schema/vega/v4.json&quot;,
"title": "High discount analysis",
"data": {
"name": "table",
"url": {
"index": "flights",
"body": {
"aggs": {
"depart_bucket": {
"terms": {"field": "airline_name"},
"aggs": {
"high_discount": {"filter": {"range": {"ticket_discount": {"gte": 0, "lte": 50}}}},
"high_percent": {
"bucket_script": {
"buckets_path": {"total": "_count", "hcnt": "high_discount._count"},
"script": "params.hcnt / params.total * 100"
}
}
}
}
},
"size": 0
}
},
"format": {"property": "aggregations.depart_bucket.buckets"},
"transform": [
{"type": "formula", "expr": "datum.doc_count", "as": "total"},
{"type": "formula", "expr": "datum.high_discount.doc_count", "as": "hcount"},
{"type": "formula", "expr": "datum.high_percent.value", "as": "hpercent"},
{"type": "collect", "sort": {"field": ["hpercent"], "order": ["descending"]}}
]
},
"scales": [
{
"name": "xscale",
"type": "band",
"domain": {"data": "table", "field": "key"},
"range": "width",
"padding": 0.05,
"round": true
},
{"name": "yscale", "domain": {"data": "table", "field": "hpercent"}, "nice": true, "range": "height"}
],
"axes": [{"orient": "bottom", "scale": "xscale"}, {"orient": "left", "scale": "yscale"}],
"marks": [
{
"type": "rect",
"from": {"data": "table"},
"encode": {
"enter": {
"x": {"scale": "xscale", "field": "key"},
"width": {"scale": "xscale", "band": 1},
"y": {"scale": "yscale", "field": "hpercent"},
"y2": {"scale": "yscale", "value": 0}
},
"update": {"fill": {"value": "steelblue"}},
"hover": {"fill": {"value": "red"}}
}
}
]
}

Marine

赞同来自:

利用空闲时间摸索了大半拉月,用Vega搞定了。
屏幕快照_2020-04-21_上午9.19_.12_.png

要回复问题请先登录注册