How to write query to find percentage in elasticsearch?

问题

I have data in elasticsearch.

this is my actual doc https://docs.google.com/document/d/1DKID90I9ulUcut-S8UfrnSjY-3citEwmyfnJJmrIRU8/edit?usp=sharing

doc:
{
  store_id:"abc",
  event_timestamp:"2019-06-05 13:00:05",
  event_type:"heartbeat"   
}

I have store_id, range of dates and event type in the input.in output, I need the percentage amount of time device was online for that hour.

This is how we consider device online. If there is an event="heartbeat" for a store_id in an hour then we say the store is online.

example 1.

so if the range is of "2019-05-07" to "2019-05-08" and there are 14 docs with different hour then the percentage will be (14/(2*24))*100

example 2.

 doc:
{
  store_id:"abc",
  event_timestamp:"2019-06-05 13:00:05",
  event_type:"heartbeat"   
}

doc:
{
  store_id:"abc",
  event_timestamp:"2019-06-05 14:00:05",
  event_type:"heartbeat"   
}

doc:
{
  store_id:"abc",
  event_timestamp:"2019-06-05 14:00:05",
  event_type:"heartbeat"   
}

if input was store_id="abc" and date_range="2019-06-05" to ""2019-06-05" and event_type="heartbeat" then output would be (2/(1*24)) because there are only two different hour with event=heartbeat of that store.

this is my query for the cumulative sum.If some How I can divide the final cumulative sum with difference between dates.

   GET /internship38/_search
{
  "query": 
  {
   "bool":
    {
      "must":
      [
        {
          "match" :
          {
            "attributes.store_id" : "41b15888-0c2f-48f9-89d0-dc7aad19f52b"
          }
        },
        {
          "match":
          {
            "event_type":"app_sent_heartbeat"
          }
        }
      ]
    }
  },


     "aggs":
  {
    "my_date_histo":{
      "date_histogram":{
        "field":"arrival_timestamp",
        "interval":"day"
      },
      "aggs":
      {
        "distinct_hours": {      
       "cardinality": {
        "script": {
          "lang": "painless",
          "source": "doc[params.date_field].value.hourOfDay;",
          "params": {
            "date_field": "arrival_timestamp"
          }
        }
      }

    },
    "cumulative_hours": {
                    "cumulative_sum": {
                        "buckets_path": "distinct_hours" 
                    }


      }

    }

}
}
} 

Can It be done in java? for example https://www.programcreek.com/java-api-examples/?api=org.elasticsearch.script.Script

回答1:

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-script-aggregation.html

Above link in the elasticsearch documentation would help if you can reformat your query into "buckets" using the "aggs" functionality.

from link:

{
    "size": 0,
    "aggs" : {
        "sales_per_month" : {
            "date_histogram" : {
                "field" : "date",
                "calendar_interval" : "month"
            },
            "aggs": {
                "total_sales": {
                    "sum": {
                        "field": "price"
                    }
                },
                "t-shirts": {
                  "filter": {
                    "term": {
                      "type": "t-shirt"
                    }
                  },
                  "aggs": {
                    "sales": {
                      "sum": {
                        "field": "price"
                      }
                    }
                  }
                },
                "t-shirt-percentage": {
                    "bucket_script": {
                        "buckets_path": {
                          "tShirtSales": "t-shirts>sales",
                          "totalSales": "total_sales"
                        },
                        "script": "params.tShirtSales / params.totalSales * 100"
                    }
                }
            }
        }
    }
}

来源：https://stackoverflow.com/questions/56929607/how-to-write-query-to-find-percentage-in-elasticsearch