ELK 信息統計分析-1

Aggregations

格式以下：

   

"aggregations"{ //能夠簡寫爲aggs

"<aggregation_name>":{ //名稱

"<aggregation_type>":{ //agg 類型

<aggregation_body> //統計字段...

},

[,"aggregations":{ [ <sub_aggregation>]+ } ]?

}

[ , "<aggregation_name_2>" : { … } ]*

}

   

如下全部測試數據均來自iis日誌

   

最值、求和、均值統計

   

1.最小值統計

   

{

"query": {

"match_all": {}

},

"aggs": {

"min_size": {

"min": { 統計最小值

"field": "time-taken" 取字段 time-taken 最小值

}

}

}

}

   

最大、求和、求平均統計只須要在類型上寫max、sum、avg

   

   

Stats、extended_stats

   

Stats 是多值統計，返回值包括最大值、最小值、求和、計數、均值等

{

"query": {

"match_all": {}

},

"aggs": {

"multi_stats": {

"stats": {

"field": "time-taken"

}

}

}

}

   

   

extended_stats 能夠在上述輸出結果上添加平方和、方差、標準差等測度。

   

   

   

Terms 用於對指定字段的內容進行分佈統計，

{

"query": {

"match_all": {}

},

"aggs": {

"terms_sc-status": {

"terms": {

"field": "sc-status",

"order": {

"_term": "desc"

}

}

}

},

"size": 20

}

   

   

   

嵌套查詢，獲取每一個狀態下的最大、最小、平均值

   

{

"query": {

"match_all": {}

},

"aggs": {

"terms_sc-status": {

"terms": {

"field": "sc-status",

"order": {

"_term": "desc"

}

},

"aggs": {

"avg_size": {

"stats": {

"field": "time-taken"

}

}

}

}

},

"size": 20

}

   

   

包含和不包含

{

"query": {

"match_all": {}

},

"aggs": {

"terms_sc-status": {

"terms": {

"field": "cs-method",

"order": {

"_term": "desc"

},

"include": "g.*", 包含，匹配全部字符用 .*

"exclude": "p.*" 不包含

},

"aggs": {

"avg_size": {

"stats": {

"field": "time-taken"

}

}

}

}

},

"size": 20

}

   

   

   

Cardinality 獲取某個字段去重後的數量

   

{

"query": {

"match_all": {}

},

"aggs": {

"aggname": {

"cardinality": {

"field": "sc-status"

}

},

"aggname1": {

"terms": {

"field": "sc-status"

}

}

},

"size": 20

}