Obsidian/Recognition/Programing/ELK/ElasticSearch 인덱스 통계.md

#EKL

• 평균 저장 건수(일,시,분,초)

GET replay_log_9_ptz-2024-05-05/_search
{
  "size": 0,
  "aggs": {
    "term": {
      "terms": {
        "field": "header.msg_type.keyword"
      },
      "aggs": {
        "stats": {
          "stats": {
            "field": "@timestamp"
          }
        },
        "avg_day": {
          "bucket_script": {
            "buckets_path": {
              "max" : "stats.max",
              "min" : "stats.min",
              "count" : "stats.count"
            },
            "script": "params.count/((params.max - params.min)/(1000 * 60 *60 * 24 ))"
          }
        },
        "avg_hour": {
          "bucket_script": {
            "buckets_path": {
              "max" : "stats.max",
              "min" : "stats.min",
              "count" : "stats.count"
            },
            "script": "params.count/((params.max - params.min)/ (1000 * 60 *60 ))"
          }
        },
        "avg_min": {
          "bucket_script": {
            "buckets_path": {
              "max" : "stats.max",
              "min" : "stats.min",
              "count" : "stats.count"
            },
            "script": "params.count/((params.max - params.min)/(1000 * 60))"
          }
        },
        "avg_seq": {
          "bucket_script": {
            "buckets_path": {
              "max" : "stats.max",
              "min" : "stats.min",
              "count" : "stats.count"
            },
            "script": "params.count/((params.max - params.min)/1000)"
          }
        }
        
      }
    }
  }
}

• 누적 메시지 건수, 메시지 사이즈

GET replay_log_1_*/_stats?filter_path=_all.total.store.size_in_bytes,_all.total.docs.count

• 인덱스별 최종 수신시각, 건수

GET _cat/count/replay_log_4_*?v

• 인덱스별 건수,용량

GET _cat/indices?v

• 특정 인덱스 최초/최종 수신 메시지

POST replay_log_9*/_search
{
  "size" : 0,
  "_source" : false,
  "aggregations" : {
    "groupby" : {
      "filters" : {
        "filters" : [
          {
            "match_all" : {
              "boost" : 1.0
            }
          }
        ],
        "other_bucket" : false,
        "other_bucket_key" : "_other_"
      },
      "aggregations" : {
        "last_msg" : {
          "top_hits" : {
            "from" : 0,
            "size" : 1,
            "version" : false,
            "seq_no_primary_term" : false,
            "explain" : false,
            "docvalue_fields" : [
              {
                "field" : "header.recv_time.keyword"
              }
            ],
            "sort" : [
              {
                "header.recv_time.keyword" : {
                  "order" : "desc",
                  "missing" : "_last",
                  "unmapped_type" : "text"
                }
              }
            ]
          }
        },
        "first_msg" : {
          "top_hits" : {
            "from" : 0,
            "size" : 1,
            "version" : false,
            "seq_no_primary_term" : false,
            "explain" : false,
            "docvalue_fields" : [
              {
                "field" : "header.recv_time.keyword"
              }
            ],
            "sort" : [
              {
                "header.recv_time.keyword" : {
                  "order" : "asc",
                  "missing" : "_last",
                  "unmapped_type" : "text"
                }
              }
            ]
          }
        }
      }
    }
  }
}

• 시간당 평균 건수

POST replay_log_10*/_search
{
  "size" : 0,
  "query" : {
    "script" : {
      "script" : {
        "source" : "InternalQlScriptUtils.nullSafeFilter(InternalQlScriptUtils.eq(InternalSqlScriptUtils.substring(InternalQlScriptUtils.docValue(doc,params.v0),params.v1,params.v2),params.v3))",
        "lang" : "painless",
        "params" : {
          "v0" : "header.recv_time.keyword",
          "v1" : 1,
          "v2" : 8,
          "v3" : "20240502"
        }
      },
      "boost" : 1.0
    }
  },
  "_source" : false,
  "aggregations" : {
    "groupby" : {
      "composite" : {
        "size" : 1000,
        "sources" : [
          {
            "46602450" : {
              "terms" : {
                "script" : {
                  "source" : "InternalSqlScriptUtils.substring(InternalQlScriptUtils.docValue(doc,params.v0),params.v1,params.v2)",
                  "lang" : "painless",
                  "params" : {
                    "v0" : "header.recv_time.keyword",
                    "v1" : 9,
                    "v2" : 2
                  }
                },
                "missing_bucket" : true,
                "value_type" : "string",
                "order" : "asc"
              }
            }
          }
        ]
      }
    }
  }
}

• 기타

// cluster 전체 통계 조회
GET /_cluster/stats

// 인덱스 통계 조회
_stats

// 사용가능한 _cat API 목록 출려
_cat
?v : 결과 header 출력
?help : 각 컬럼(header) 상세 정보 출력
?h={column name},{column name} : 선택 컬럼만 출력
-------------------------------------------------
=^.^=
/_cat/allocation
/_cat/shards
/_cat/shards/{index}
/_cat/master
/_cat/nodes
/_cat/tasks
/_cat/indices
/_cat/indices/{index}
/_cat/segments
/_cat/segments/{index}
/_cat/count
/_cat/count/{index}
/_cat/recovery
/_cat/recovery/{index}
/_cat/health
/_cat/pending_tasks
/_cat/aliases
/_cat/aliases/{alias}
/_cat/thread_pool
/_cat/thread_pool/{thread_pools}
/_cat/plugins
/_cat/fielddata
/_cat/fielddata/{fields}
/_cat/nodeattrs
/_cat/repositories
/_cat/snapshots/{repository}
/_cat/templates
/_cat/ml/anomaly_detectors
/_cat/ml/anomaly_detectors/{job_id}
/_cat/ml/trained_models
/_cat/ml/trained_models/{model_id}
/_cat/ml/datafeeds
/_cat/ml/datafeeds/{datafeed_id}
/_cat/ml/data_frame/analytics
/_cat/ml/data_frame/analytics/{id}
/_cat/transforms
/_cat/transforms/{transform_id}
-------------------------------------------------