Examples with ParsedDateHistogram org.graylog.shaded.elasticsearch7.org.elasticsearch.search.aggregations.bucket.histogram.ParsedDateHistogram used on opensource projects

Example 1 with ParsedDateHistogram

use of org.graylog.shaded.elasticsearch7.org.elasticsearch.search.aggregations.bucket.histogram.ParsedDateHistogram in project graylog2-server by Graylog2.

the class IndexToolsAdapterES7 method fieldHistogram.

@Override
public Map<DateTime, Map<String, Long>> fieldHistogram(String fieldName, Set<String> indices, Optional<Set<String>> includedStreams, long interval) {
    final BoolQueryBuilder queryBuilder = buildStreamIdFilter(includedStreams);
    final FilterAggregationBuilder the_filter = AggregationBuilders.filter(AGG_FILTER, queryBuilder).subAggregation(AggregationBuilders.dateHistogram(AGG_DATE_HISTOGRAM).field("timestamp").subAggregation(AggregationBuilders.terms(AGG_MESSAGE_FIELD).field(fieldName)).fixedInterval(new DateHistogramInterval(interval + "ms")).minDocCount(1L));
    final SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder().query(QueryBuilders.matchAllQuery()).aggregation(the_filter);
    final SearchRequest searchRequest = new SearchRequest().source(searchSourceBuilder).indices(indices.toArray(new String[0]));
    final SearchResponse searchResult = client.search(searchRequest, "Unable to retrieve field histogram.");
    final Filter filterAggregation = searchResult.getAggregations().get(AGG_FILTER);
    final ParsedDateHistogram dateHistogram = filterAggregation.getAggregations().get(AGG_DATE_HISTOGRAM);
    final List<ParsedDateHistogram.ParsedBucket> histogramBuckets = (List<ParsedDateHistogram.ParsedBucket>) dateHistogram.getBuckets();
    final Map<DateTime, Map<String, Long>> result = Maps.newHashMapWithExpectedSize(histogramBuckets.size());
    for (ParsedDateHistogram.ParsedBucket bucket : histogramBuckets) {
        final ZonedDateTime zonedDateTime = (ZonedDateTime) bucket.getKey();
        final DateTime date = new DateTime(zonedDateTime.toInstant().toEpochMilli()).toDateTime(DateTimeZone.UTC);
        final Terms sourceFieldAgg = bucket.getAggregations().get(AGG_MESSAGE_FIELD);
        final List<? extends Terms.Bucket> termBuckets = sourceFieldAgg.getBuckets();
        final HashMap<String, Long> termCounts = Maps.newHashMapWithExpectedSize(termBuckets.size());
        for (Terms.Bucket termBucket : termBuckets) {
            termCounts.put(termBucket.getKeyAsString(), termBucket.getDocCount());
        }
        result.put(date, termCounts);
    }
    return ImmutableMap.copyOf(result);
}