Examples with Filter org.elasticsearch.search.aggregations.bucket.filter.Filter used on opensource projects

Example 16 with Filter

use of org.elasticsearch.search.aggregations.bucket.filter.Filter in project elasticsearch by elastic.

the class MaxBucketIT method testMetricAsSubAggOfSingleBucketAgg.

public void testMetricAsSubAggOfSingleBucketAgg() throws Exception {
    SearchResponse response = client().prepareSearch("idx").addAggregation(filter("filter", termQuery("tag", "tag0")).subAggregation(histogram("histo").field(SINGLE_VALUED_FIELD_NAME).interval(interval).extendedBounds(minRandomValue, maxRandomValue).subAggregation(sum("sum").field(SINGLE_VALUED_FIELD_NAME))).subAggregation(maxBucket("max_bucket", "histo>sum"))).execute().actionGet();
    assertSearchResponse(response);
    Filter filter = response.getAggregations().get("filter");
    assertThat(filter, notNullValue());
    assertThat(filter.getName(), equalTo("filter"));
    Histogram histo = filter.getAggregations().get("histo");
    assertThat(histo, notNullValue());
    assertThat(histo.getName(), equalTo("histo"));
    List<? extends Bucket> buckets = histo.getBuckets();
    List<String> maxKeys = new ArrayList<>();
    double maxValue = Double.NEGATIVE_INFINITY;
    for (int j = 0; j < numValueBuckets; ++j) {
        Histogram.Bucket bucket = buckets.get(j);
        assertThat(bucket, notNullValue());
        assertThat(((Number) bucket.getKey()).longValue(), equalTo((long) j * interval));
        if (bucket.getDocCount() != 0) {
            Sum sum = bucket.getAggregations().get("sum");
            assertThat(sum, notNullValue());
            if (sum.value() > maxValue) {
                maxValue = sum.value();
                maxKeys = new ArrayList<>();
                maxKeys.add(bucket.getKeyAsString());
            } else if (sum.value() == maxValue) {
                maxKeys.add(bucket.getKeyAsString());
            }
        }
    }
    InternalBucketMetricValue maxBucketValue = filter.getAggregations().get("max_bucket");
    assertThat(maxBucketValue, notNullValue());
    assertThat(maxBucketValue.getName(), equalTo("max_bucket"));
    assertThat(maxBucketValue.value(), equalTo(maxValue));
    assertThat(maxBucketValue.keys(), equalTo(maxKeys.toArray(new String[maxKeys.size()])));
}

Example 17 with Filter

use of org.elasticsearch.search.aggregations.bucket.filter.Filter in project graylog2-server by Graylog2.

the class Indices method indexRangeStatsOfIndex.

/**
     * Calculate min and max message timestamps in the given index.
     *
     * @param index Name of the index to query.
     * @return the timestamp stats in the given index, or {@code null} if they couldn't be calculated.
     * @see org.elasticsearch.search.aggregations.metrics.stats.Stats
     */
public IndexRangeStats indexRangeStatsOfIndex(String index) {
    final FilterAggregationBuilder builder = AggregationBuilders.filter("agg").filter(QueryBuilders.existsQuery("timestamp")).subAggregation(AggregationBuilders.min("ts_min").field("timestamp")).subAggregation(AggregationBuilders.max("ts_max").field("timestamp")).subAggregation(AggregationBuilders.terms("streams").field("streams"));
    final SearchRequestBuilder srb = c.prepareSearch().setIndices(index).setSearchType(SearchType.QUERY_THEN_FETCH).setSize(0).addAggregation(builder);
    final SearchResponse response;
    try {
        final SearchRequest request = srb.request();
        if (LOG.isDebugEnabled()) {
            LOG.debug("Index range query: _search/{}: {}", index, XContentHelper.convertToJson(request.source(), false));
        }
        response = c.search(request).actionGet();
    } catch (IndexClosedException e) {
        throw e;
    } catch (org.elasticsearch.index.IndexNotFoundException e) {
        LOG.error("Error while calculating timestamp stats in index <" + index + ">", e);
        throw e;
    } catch (ElasticsearchException e) {
        LOG.error("Error while calculating timestamp stats in index <" + index + ">", e);
        throw new org.elasticsearch.index.IndexNotFoundException("Index " + index + " not found", e);
    } catch (IOException e) {
        // the index range aggregation query on DEBUG (via XContentHelper)
        throw new RuntimeException(e);
    }
    final Filter f = response.getAggregations().get("agg");
    if (f.getDocCount() == 0L) {
        LOG.debug("No documents with attribute \"timestamp\" found in index <{}>", index);
        return IndexRangeStats.EMPTY;
    }
    final Min minAgg = f.getAggregations().get("ts_min");
    final DateTime min = new DateTime((long) minAgg.getValue(), DateTimeZone.UTC);
    final Max maxAgg = f.getAggregations().get("ts_max");
    final DateTime max = new DateTime((long) maxAgg.getValue(), DateTimeZone.UTC);
    // make sure we return an empty list, so we can differentiate between old indices that don't have this information
    // and newer ones that simply have no streams.
    ImmutableList.Builder<String> streamIds = ImmutableList.builder();
    final Terms streams = f.getAggregations().get("streams");
    if (!streams.getBuckets().isEmpty()) {
        streamIds.addAll(streams.getBuckets().stream().map(Terms.Bucket::getKeyAsString).collect(toSet()));
    }
    return IndexRangeStats.create(min, max, streamIds.build());
}

Example 18 with Filter

use of org.elasticsearch.search.aggregations.bucket.filter.Filter in project graylog2-server by Graylog2.

the class Searches method fieldHistogram.

public HistogramResult fieldHistogram(String query, String field, DateHistogramInterval interval, String filter, TimeRange range, boolean includeCardinality) throws FieldTypeException {
    final DateHistogramBuilder dateHistogramBuilder = AggregationBuilders.dateHistogram(AGG_HISTOGRAM).field("timestamp").subAggregation(AggregationBuilders.stats(AGG_STATS).field(field)).interval(interval.toESInterval());
    if (includeCardinality) {
        dateHistogramBuilder.subAggregation(AggregationBuilders.cardinality(AGG_CARDINALITY).field(field));
    }
    FilterAggregationBuilder builder = AggregationBuilders.filter(AGG_FILTER).subAggregation(dateHistogramBuilder).filter(standardAggregationFilters(range, filter));
    QueryStringQueryBuilder qs = queryStringQuery(query);
    qs.allowLeadingWildcard(configuration.isAllowLeadingWildcardSearches());
    SearchRequestBuilder srb = c.prepareSearch();
    final Set<String> affectedIndices = determineAffectedIndices(range, filter);
    srb.setIndices(affectedIndices.toArray(new String[affectedIndices.size()]));
    srb.setQuery(qs);
    srb.addAggregation(builder);
    SearchResponse r;
    final SearchRequest request = srb.request();
    try {
        r = c.search(request).actionGet();
    } catch (org.elasticsearch.action.search.SearchPhaseExecutionException e) {
        throw new FieldTypeException(e);
    }
    checkForFailedShards(r);
    recordEsMetrics(r, range);
    final Filter f = r.getAggregations().get(AGG_FILTER);
    return new FieldHistogramResult(f.getAggregations().get(AGG_HISTOGRAM), query, request.source(), interval, r.getTook());
}

Example 19 with Filter

use of org.elasticsearch.search.aggregations.bucket.filter.Filter in project graylog2-server by Graylog2.

the class Searches method termsStats.

public TermsStatsResult termsStats(String keyField, String valueField, TermsStatsOrder order, int size, String query, String filter, TimeRange range) {
    if (size == 0) {
        size = 50;
    }
    SearchRequestBuilder srb;
    if (filter == null) {
        srb = standardSearchRequest(query, determineAffectedIndices(range, filter), range);
    } else {
        srb = filteredSearchRequest(query, filter, determineAffectedIndices(range, filter), range);
    }
    Terms.Order termsOrder;
    switch(order) {
        case COUNT:
            termsOrder = Terms.Order.count(true);
            break;
        case REVERSE_COUNT:
            termsOrder = Terms.Order.count(false);
            break;
        case TERM:
            termsOrder = Terms.Order.term(true);
            break;
        case REVERSE_TERM:
            termsOrder = Terms.Order.term(false);
            break;
        case MIN:
            termsOrder = Terms.Order.aggregation(AGG_STATS, "min", true);
            break;
        case REVERSE_MIN:
            termsOrder = Terms.Order.aggregation(AGG_STATS, "min", false);
            break;
        case MAX:
            termsOrder = Terms.Order.aggregation(AGG_STATS, "max", true);
            break;
        case REVERSE_MAX:
            termsOrder = Terms.Order.aggregation(AGG_STATS, "max", false);
            break;
        case MEAN:
            termsOrder = Terms.Order.aggregation(AGG_STATS, "avg", true);
            break;
        case REVERSE_MEAN:
            termsOrder = Terms.Order.aggregation(AGG_STATS, "avg", false);
            break;
        case TOTAL:
            termsOrder = Terms.Order.aggregation(AGG_STATS, "sum", true);
            break;
        case REVERSE_TOTAL:
            termsOrder = Terms.Order.aggregation(AGG_STATS, "sum", false);
            break;
        default:
            termsOrder = Terms.Order.count(true);
    }
    FilterAggregationBuilder builder = AggregationBuilders.filter(AGG_FILTER).subAggregation(AggregationBuilders.terms(AGG_TERMS_STATS).field(keyField).subAggregation(AggregationBuilders.stats(AGG_STATS).field(valueField)).order(termsOrder).size(size)).filter(standardAggregationFilters(range, filter));
    srb.addAggregation(builder);
    final SearchRequest request = srb.request();
    SearchResponse r = c.search(request).actionGet();
    recordEsMetrics(r, range);
    final Filter f = r.getAggregations().get(AGG_FILTER);
    return new TermsStatsResult(f.getAggregations().get(AGG_TERMS_STATS), query, request.source(), r.getTook());
}

Example 20 with Filter

use of org.elasticsearch.search.aggregations.bucket.filter.Filter in project sonarqube by SonarSource.

the class Facets method processSubAggregations.

private void processSubAggregations(HasAggregations aggregation) {
    if (Filter.class.isAssignableFrom(aggregation.getClass())) {
        Filter filter = (Filter) aggregation;
        if (filter.getName().startsWith(NO_DATA_PREFIX)) {
            LinkedHashMap<String, Long> facet = getOrCreateFacet(filter.getName().replaceFirst(NO_DATA_PREFIX, ""));
            facet.put("NO_DATA", ((Filter) aggregation).getDocCount());
        }
    }
    for (Aggregation sub : aggregation.getAggregations()) {
        processAggregation(sub);
    }
}