{
"query": {
"bool": {
"must": [
{
"term": {
"child3DepartmentId": "00065308"
}
},
{
"terms": {
"serverUseType": [
"1",
"3"
]
}
},
{
"term": {
"metric": "cpu.usage"
}
}
]
}
},
"size": 0,
"aggs": {
"child2DepartmentIdgb": {
"terms": {
"field": "child2DepartmentId",
"size": 100
},
"aggs": {
"child3DepartmentIdgb": {
"terms": {
"field": "child3DepartmentId",
"size": 100
},
"aggs": {
"zones": {
"terms": {
"field": "projectId",
"size": 200
},
"aggs": {
"load_times": {
"percentiles": {
"field": "value",
"percents": [
100,
99.99,
99.9,
99.8,
99.7,
99,
98,
97,
96,
95,
94,
93,
92,
91,
90,
80,
70,
60,
50,
40,
30,
20,
10
]
}
},
"extended_stats": {
"extended_stats": {
"field": "value"
}
}
}
}
}
}
}
}
}
}
{
"query": {
"bool": {
"must": [
{
"terms": {
"child2DepartmentId": [
"00033132",
"00048471",
"00053749",
"00065244",
"00065253",
"00065259",
"00065265",
"00065272",
"00065280",
"00065285",
"00065303",
"00068776",
"00070152",
"00075235"
]
}
},
{
"terms": {
"serverUseType": [
"1",
"3"
]
}
},
{
"term": {
"metric": "cpu.usage"
}
}
]
}
},
"size": 0,
"aggs": {
"child2DepartmentIdgb": {
"terms": {
"field": "child2DepartmentId",
"size": 100
},
"aggs": {
"child3DepartmentIdgb": {
"terms": {
"field": "child3DepartmentId",
"size": 100
},
"aggs": {
"zones": {
"terms": {
"field": "projectId",
"size": 5000
},
"aggs": {
"load_times": {
"percentiles": {
"field": "value",
"percents": [
100,
90,
80,
70,
60,
50,
40,
30,
20,
10
]
}
},
"extended_stats": {
"extended_stats": {
"field": "value"
}
}
}
}
}
}
}
}
}
}
{
"size": 0,
"query": {
"bool": {
"must" : {},
"filter": {
"terms": {
"metric": [
"cpu.usage",
"cpu.busy"
]
}
}
}
},
"aggs": {
"group_by_child2Department": {
"terms": {
"size":50,
"field": "child2DepartmentId",
"order": {
"max_value": "desc"
}
},
"aggs": {
"max_value": {
"max": {
"field": "value"
}
}
}
}
}
}
{
"size": 0,
"query": {
"bool": {
"must": {
"match": {
"metric": "load.5min"
}
},
"filter": {
"range": {
"time": {
"gt": 1529251200,
"lt": 1529337599
}
}
}
}
},
"aggs": {
"avg_value": {
"avg": {
"field": "value"
}
}
}
}
SearchRequestBuilder search = esTransportClient.prepareSearch(dateString).setSize(0).setTypes("monitor");
QueryBuilder qb = boolQuery()
.must(matchQuery("metric", metric))
.filter(rangeQuery("time").gt(beginDateTime).lt(endDateTime));
search.setQuery(qb);
AggregationBuilder aggregation = AggregationBuilders
.terms("group_by_child2Department")
.size(50)
.field("child2DepartmentId")
.order(Terms.Order.aggregation("max_value", false))
.subAggregation(
AggregationBuilders.max("max_value").field("value"));
search.addAggregation(aggregation);
SearchResponse response = search.execute().actionGet();
Terms endpointTerms = response.getAggregations().get("group_by_child2Department");
// List<CmdbAssetProject> listfromBeginToEnd = new ArrayList<CmdbAssetProject>();
for (Terms.Bucket entry:
endpointTerms.getBuckets()) {
logger.debug("进入聚合结果分析:");
String child2DepartmentId = entry.getKeyAsString();
String child2Department = DepartmentMapCache.departmentMap.get(child2DepartmentId);
Max max = entry.getAggregations().get("max_value");
Double maxValue = max.getValue();
logger.debug("child2Department " + child2Department);
logger.debug("maxValue:" + maxValue);
// 调用通过ip查询资产信息的接口去查询出来部门和应用信息
// CmdbAssetProject cmdbAssetProject = new CmdbAssetProject();
CmdbAssetProject cmdbAssetProject = new CmdbAssetProject();
cmdbAssetProject.setValue(maxValue);
cmdbAssetProject.setDepartment(child2Department);
logger.debug(cmdbAssetProject);
// listfromBeginToEnd.add(cmdbAssetProject);
if (tmpMap.get(cmdbAssetProject.getDepartment()) == null){
List<Double> list = new ArrayList<Double>();
list.add(cmdbAssetProject.getValue());
tmpMap.put(cmdbAssetProject.getDepartment(),list);
}else{
List<Double> list = (List<Double>) tmpMap.get(cmdbAssetProject.getDepartment());
list.add(cmdbAssetProject.getValue());
tmpMap.put(cmdbAssetProject.getDepartment(),list);
}
}
{
"size": 0,
"query": {
"match": {
"metric": "load.5min"
}
},
"aggs": {
"group_by_endpoint": {
"terms": {
"field": "endpoint",
"order": {
"max_value": "desc"
}
},
"aggs": {
"max_value": {
"max": {
"field": "value"
}
}
}
}
}
}
{
"size": 0,
"query": {
"bool": {
"must": [
{
"term": {
"metric": "net.if.in.bytes"
}
},
{
"range": {
"time": {
"gt": 1552838400,
"lt": 1553443199
}
}
},
{
"term": {
"endpoint": "10.175.9.235"
}
}
]
}
},
"aggs": {
"avg_value": {
"avg": {
"field": "value"
}
}
}
}
原文：https://www.cnblogs.com/PythonOrg/p/14519513.html