API tools faq
paste
Guest User

Untitled

a guest
Feb 21st, 2018
69
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 8.40 KB | None | 0 0
raw download clone embed print report
  1. final BoolQueryBuilder queryBuilder = boolQuery();
  2. queryBuilder.must(matchQuery("metricset.module", "system"));
  3. queryBuilder.must(matchQuery("metricset.name", "filesystem"));
  4. queryBuilder.must(rangeQuery("@timestamp").from(request.getFrom()).to(request.getTo()));
  5.  
  6. final SearchRequest searchRequest = new SearchRequest()
  7. .indices(MetricBeatIndicesUtils.between(request.getFrom(), request.getTo()))
  8. .indicesOptions(IndicesOptions.lenientExpandOpen())
  9. .source(new SearchSourceBuilder().query(queryBuilder).size(0).aggregation(
  10. terms("host").field("beat.hostname").size(2)
  11. .subAggregation(terms("mount").field("system.filesystem.mount_point").size(3).order(BucketOrder.aggregation("used", false))
  12. .subAggregation(avg("used").field("system.filesystem.used.pct")))
  13. ));
  14.  
  15. return restClient.search(searchRequest);
  16.  
  17. {
  18. "size": 0,
  19. "query": {
  20. "bool": {
  21. "must": [
  22. {
  23. "match": {
  24. "metricset.module": {
  25. "query": "system",
  26. "operator": "OR",
  27. "prefix_length": 0,
  28. "max_expansions": 50,
  29. "fuzzy_transpositions": true,
  30. "lenient": false,
  31. "zero_terms_query": "NONE",
  32. "auto_generate_synonyms_phrase_query": true,
  33. "boost": 1
  34. }
  35. }
  36. },
  37. {
  38. "match": {
  39. "metricset.name": {
  40. "query": "filesystem",
  41. "operator": "OR",
  42. "prefix_length": 0,
  43. "max_expansions": 50,
  44. "fuzzy_transpositions": true,
  45. "lenient": false,
  46. "zero_terms_query": "NONE",
  47. "auto_generate_synonyms_phrase_query": true,
  48. "boost": 1
  49. }
  50. }
  51. },
  52. {
  53. "range": {
  54. "@timestamp": {
  55. "from": "2018-02-03T23:30:00.000Z",
  56. "to": "2018-02-04T23:30:00.000Z",
  57. "include_lower": true,
  58. "include_upper": true,
  59. "boost": 1
  60. }
  61. }
  62. }
  63. ],
  64. "adjust_pure_negative": true,
  65. "boost": 1
  66. }
  67. },
  68. "aggregations": {
  69. "host": {
  70. "terms": {
  71. "field": "beat.hostname",
  72. "size": 2,
  73. "min_doc_count": 1,
  74. "shard_min_doc_count": 0,
  75. "show_term_doc_count_error": false,
  76. "order": [
  77. {
  78. "_count": "desc"
  79. },
  80. {
  81. "_key": "asc"
  82. }
  83. ]
  84. },
  85. "aggregations": {
  86. "mount": {
  87. "terms": {
  88. "field": "system.filesystem.mount_point",
  89. "size": 3,
  90. "min_doc_count": 1,
  91. "shard_min_doc_count": 0,
  92. "show_term_doc_count_error": false,
  93. "order": [
  94. {
  95. "used": "desc"
  96. },
  97. {
  98. "_key": "asc"
  99. }
  100. ]
  101. },
  102. "aggregations": {
  103. "used": {
  104. "avg": {
  105. "field": "system.filesystem.used.pct"
  106. }
  107. }
  108. }
  109. }
  110. }
  111. }
  112. }
  113. }
  114.  
  115. {
  116. "took": 49,
  117. "timed_out": false,
  118. "_shards": {
  119. "total": 10,
  120. "successful": 10,
  121. "skipped": 0,
  122. "failed": 0
  123. },
  124. "hits": {
  125. "total": 207333,
  126. "max_score": 0,
  127. "hits": []
  128. },
  129. "aggregations": {
  130. "host": {
  131. "doc_count_error_upper_bound": 0,
  132. "sum_other_doc_count": 0,
  133. "buckets": [
  134. {
  135. "key": "redis01.lab.com",
  136. "doc_count": 52648,
  137. "mount": {
  138. "doc_count_error_upper_bound": -1,
  139. "sum_other_doc_count": 48418,
  140. "buckets": [
  141. {
  142. "key": "/usr",
  143. "doc_count": 1410,
  144. "used": {
  145. "value": 0.6939999999999973
  146. }
  147. },
  148. {
  149. "key": "/var",
  150. "doc_count": 1410,
  151. "used": {
  152. "value": 0.515960992907802
  153. }
  154. },
  155. {
  156. "key": "/boot",
  157. "doc_count": 1410,
  158. "used": {
  159. "value": 0.4309999999999983
  160. }
  161. }
  162. ]
  163. }
  164. },
  165. {
  166. "key": "redis02.lab.com",
  167. "doc_count": 52507,
  168. "mount": {
  169. "doc_count_error_upper_bound": -1,
  170. "sum_other_doc_count": 48277,
  171. "buckets": [
  172. {
  173. "key": "/usr",
  174. "doc_count": 1410,
  175. "used": {
  176. "value": 0.6939999999999972
  177. }
  178. },
  179. {
  180. "key": "/var",
  181. "doc_count": 1410,
  182. "used": {
  183. "value": 0.46478865248226925
  184. }
  185. },
  186. {
  187. "key": "/boot",
  188. "doc_count": 1410,
  189. "used": {
  190. "value": 0.4309999999999981
  191. }
  192. }
  193. ]
  194. }
  195. },
  196. {
  197. "key": "rabbit01.lab.com",
  198. "doc_count": 51096,
  199. "mount": {
  200. "doc_count_error_upper_bound": -1,
  201. "sum_other_doc_count": 46866,
  202. "buckets": [
  203. {
  204. "key": "/usr",
  205. "doc_count": 1410,
  206. "used": {
  207. "value": 0.7700000000000036
  208. }
  209. },
  210. {
  211. "key": "/var",
  212. "doc_count": 1410,
  213. "used": {
  214. "value": 0.4819092198581554
  215. }
  216. },
  217. {
  218. "key": "/boot",
  219. "doc_count": 1410,
  220. "used": {
  221. "value": 0.43200000000000144
  222. }
  223. }
  224. ]
  225. }
  226. },
  227. {
  228. "key": "rabbit02.lab.com",
  229. "doc_count": 51082,
  230. "mount": {
  231. "doc_count_error_upper_bound": -1,
  232. "sum_other_doc_count": 46852,
  233. "buckets": [
  234. {
  235. "key": "/usr",
  236. "doc_count": 1410,
  237. "used": {
  238. "value": 0.7669999999999976
  239. }
  240. },
  241. {
  242. "key": "/var",
  243. "doc_count": 1410,
  244. "used": {
  245. "value": 0.4815425531914893
  246. }
  247. },
  248. {
  249. "key": "/boot",
  250. "doc_count": 1410,
  251. "used": {
  252. "value": 0.4320000000000014
  253. }
  254. }
  255. ]
  256. }
  257. }
  258. ]
  259. }
  260. }
  261. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!