如何排除Elasticsearch date histogram中doc count为0的桶并统计有效桶数

要排除date histogram中doc count为0的桶并统计有效桶数，只需两步调整：

1. 修改date_histogram聚合，过滤空桶
   在docsOverTimeFrame的date_histogram配置中添加"min_doc_count": 1参数，Elasticsearch会自动剔除所有文档数为0的桶：

"docsOverTimeFrame": {
  "date_histogram": {
    "field": "@timestamp",
    "fixed_interval": "10s",
    "min_doc_count": 1  // 新增此参数，仅保留有文档的桶
  }
}

2. 调整bucket selector的判断逻辑
   此时docsOverTimeFrame._bucket_count会返回过滤后的有效桶数量（即你期望的2），把bucket selector的脚本条件改为对应数值即可：

"min_bucket_selector": {
  "bucket_selector": {
    "buckets_path": {
      "count": "docsOverTimeFrame._bucket_count" 
    },
    "script": {
      "source": "params.count == 2"  // 改为有效桶的目标数量
    }
  }
}

完整修改后的查询 #

GET metricbeat-*/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "host.cpu.usage": {
              "gte": 0.8
            }
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2022-09-22T10:16:00.000Z",
              "lte": "2022-09-22T10:18:00.000Z"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "hostName": {
      "terms": {
        "field": "host.name"
      },
      "aggs": {
        "docsOverTimeFrame": {
          "date_histogram": {
            "field": "@timestamp",
            "fixed_interval": "10s",
            "min_doc_count": 1
          }
        },
        "min_bucket_selector": {
          "bucket_selector": {
            "buckets_path": {
              "count": "docsOverTimeFrame._bucket_count" 
            },
            "script": {
              "source": "params.count == 2"
            }
          }
        }
      }
    }
  }
}

如果需要直接在聚合结果中返回每个主机的有效桶数量，可以额外添加一个bucket_script聚合：

"valid_bucket_count": {
  "bucket_script": {
    "buckets_path": {
      "count": "docsOverTimeFrame._bucket_count"
    },
    "script": "params.count"
  }
}

内容的提问来源于stack exchange，提问作者Bhavya