Elasticsearch仪表板新用户计数结果不一致问题排查求助

安全阿岳

2026-7-6

Elasticsearch新用户计数不一致问题排查求助

问题详情

环境：Elasticsearch 8.4.1，仪表板追踪5月至8月数据，展示活跃用户、新用户、消息总数
异常现象：新用户计数结果不稳定，如7月原计数1902，复测变为1903；8月原计数3894，现变为3899。但活跃用户、消息总数的计数始终保持一致
字段说明：活跃用户统计使用dateTime字段，新用户统计使用created_date字段，两者字段类型一致：

"created_date": {
"type": "date_nanos",
"store": true,
"format": "date_optional_time"
}

新用户计数的Java实现代码

private Terms getNewUsersTerms(Integer botId, String from, String to) {
try {
    RestHighLevelClient client = getElasticClient(botId);

    AggregationBuilder aggregationBuilder = AggregationBuilders.terms("uniqueIds").field("currentState.user.id").size(Integer.MAX_VALUE);

    QueryBuilder queryBuilder = QueryBuilders.boolQuery()
        .must(QueryBuilders.matchAllQuery())
        .filter(QueryBuilders.rangeQuery("currentState.created_date").gte("2023-08-01").lte("2023-08-31"));

    SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder()
        .aggregation(aggregationBuilder)
        .query(queryBuilder).size(0);

    SearchRequest searchRequest = new SearchRequest(botId + INDEX_POSTFIX)
        .source(searchSourceBuilder);

    SearchResponse searchResponse = client.search(searchRequest, RequestOptions.DEFAULT);
    return searchResponse.getAggregations().get("uniqueIds");
} catch (Exception e) {
    logger.warn(e.getMessage(), e);
    return null;
}}