Obsidian/Recognition/Programing/ELK/ElasticSearch 인덱스 통계.md

274 lines
5.9 KiB
Markdown
Raw Normal View History

2024-05-09 09:01:30 +00:00
#EKL
- 평균 저장 건수(일,시,분,초)
```json
GET replay_log_9_ptz-2024-05-05/_search
{
"size": 0,
"aggs": {
"term": {
"terms": {
"field": "header.msg_type.keyword"
},
"aggs": {
"stats": {
"stats": {
"field": "@timestamp"
}
},
"avg_day": {
"bucket_script": {
"buckets_path": {
"max" : "stats.max",
"min" : "stats.min",
"count" : "stats.count"
},
"script": "params.count/((params.max - params.min)/(1000 * 60 *60 * 24 ))"
}
},
"avg_hour": {
"bucket_script": {
"buckets_path": {
"max" : "stats.max",
"min" : "stats.min",
"count" : "stats.count"
},
"script": "params.count/((params.max - params.min)/ (1000 * 60 *60 ))"
}
},
"avg_min": {
"bucket_script": {
"buckets_path": {
"max" : "stats.max",
"min" : "stats.min",
"count" : "stats.count"
},
"script": "params.count/((params.max - params.min)/(1000 * 60))"
}
},
"avg_seq": {
"bucket_script": {
"buckets_path": {
"max" : "stats.max",
"min" : "stats.min",
"count" : "stats.count"
},
"script": "params.count/((params.max - params.min)/1000)"
}
}
}
}
}
}
```
- 누적 메시지 건수, 메시지 사이즈
```json
GET replay_log_1_*/_stats?filter_path=_all.total.store.size_in_bytes,_all.total.docs.count
```
- 인덱스별 최종 수신시각, 건수
```json
GET _cat/count/replay_log_4_*?v
```
- 인덱스별 건수,용량
```json
GET _cat/indices?v
```
- 특정 인덱스 최초/최종 수신 메시지
```json
POST replay_log_9*/_search
{
"size" : 0,
"_source" : false,
"aggregations" : {
"groupby" : {
"filters" : {
"filters" : [
{
"match_all" : {
"boost" : 1.0
}
}
],
"other_bucket" : false,
"other_bucket_key" : "_other_"
},
"aggregations" : {
"last_msg" : {
"top_hits" : {
"from" : 0,
"size" : 1,
"version" : false,
"seq_no_primary_term" : false,
"explain" : false,
"docvalue_fields" : [
{
"field" : "header.recv_time.keyword"
}
],
"sort" : [
{
"header.recv_time.keyword" : {
"order" : "desc",
"missing" : "_last",
"unmapped_type" : "text"
}
}
]
}
},
"first_msg" : {
"top_hits" : {
"from" : 0,
"size" : 1,
"version" : false,
"seq_no_primary_term" : false,
"explain" : false,
"docvalue_fields" : [
{
"field" : "header.recv_time.keyword"
}
],
"sort" : [
{
"header.recv_time.keyword" : {
"order" : "asc",
"missing" : "_last",
"unmapped_type" : "text"
}
}
]
}
}
}
}
}
}
```
- 시간당 평균 건수
```json
POST replay_log_10*/_search
{
"size" : 0,
"query" : {
"script" : {
"script" : {
"source" : "InternalQlScriptUtils.nullSafeFilter(InternalQlScriptUtils.eq(InternalSqlScriptUtils.substring(InternalQlScriptUtils.docValue(doc,params.v0),params.v1,params.v2),params.v3))",
"lang" : "painless",
"params" : {
"v0" : "header.recv_time.keyword",
"v1" : 1,
"v2" : 8,
"v3" : "20240502"
}
},
"boost" : 1.0
}
},
"_source" : false,
"aggregations" : {
"groupby" : {
"composite" : {
"size" : 1000,
"sources" : [
{
"46602450" : {
"terms" : {
"script" : {
"source" : "InternalSqlScriptUtils.substring(InternalQlScriptUtils.docValue(doc,params.v0),params.v1,params.v2)",
"lang" : "painless",
"params" : {
"v0" : "header.recv_time.keyword",
"v1" : 9,
"v2" : 2
}
},
"missing_bucket" : true,
"value_type" : "string",
"order" : "asc"
}
}
}
]
}
}
}
}
```
- 기타
```json
// cluster 전체 통계 조회
GET /_cluster/stats
// 인덱스 통계 조회
_stats
// 사용가능한 _cat API 목록 출려
_cat
?v : 결과 header 출력
?help : 각 컬럼(header) 상세 정보 출력
?h={column name},{column name} : 선택 컬럼만 출력
-------------------------------------------------
=^.^=
/_cat/allocation
/_cat/shards
/_cat/shards/{index}
/_cat/master
/_cat/nodes
/_cat/tasks
/_cat/indices
/_cat/indices/{index}
/_cat/segments
/_cat/segments/{index}
/_cat/count
/_cat/count/{index}
/_cat/recovery
/_cat/recovery/{index}
/_cat/health
/_cat/pending_tasks
/_cat/aliases
/_cat/aliases/{alias}
/_cat/thread_pool
/_cat/thread_pool/{thread_pools}
/_cat/plugins
/_cat/fielddata
/_cat/fielddata/{fields}
/_cat/nodeattrs
/_cat/repositories
/_cat/snapshots/{repository}
/_cat/templates
/_cat/ml/anomaly_detectors
/_cat/ml/anomaly_detectors/{job_id}
/_cat/ml/trained_models
/_cat/ml/trained_models/{model_id}
/_cat/ml/datafeeds
/_cat/ml/datafeeds/{datafeed_id}
/_cat/ml/data_frame/analytics
/_cat/ml/data_frame/analytics/{id}
/_cat/transforms
/_cat/transforms/{transform_id}
-------------------------------------------------
```