按月分组的ElasticSearch聚合信息

Question

我正在处理一个ElasticSearch查询，该查询应该让我回到所有文档现在是1年前的日期字段，然后按月对它们进行分组（每个月给我总数），但是我没有写这个查询。

这是我有：

{ 
    "query": { 
    "bool": { 
     "must": [ 
     { 
      "terms": { 
      "account_id": [ 
       1 
      ] 
      } 
     } 
     ] 
    } 
    }, 
    "aggs": { 
    "growth": { 
     "date_range": { 
     "field": "member_since", 
     "format": "YYYY-MM-DD", 
     "ranges": [ 
      { 
      "to": "now-1Y/M" 
      }, 
      { 
      "from": "now-1Y/M" 
      } 
     ] 
     } 
    } 
    }, 
    "size": 100 
} 

我运行像这样的查询：

POST https://my-es-cluster-url.com，但我不断收到此错误：

{ 
    "error": { 
    "root_cause": [ 
     { 
     "type": "parse_exception", 
     "reason": "unit [Y] not supported for date math [-1Y/M]" 
     } 
    ], 
    "type": "search_phase_execution_exception", 
    "reason": "all shards failed", 
    "phase": "query_fetch", 
    "grouped": true, 
    "failed_shards": [ 
     { 
     "shard": 0, 
     "index": "index0", 
     "node": "MkypXlGdQamAplca1JIgZQ", 
     "reason": { 
      "type": "parse_exception", 
      "reason": "unit [Y] not supported for date math [-1Y/M]" 
     } 
     } 
    ] 
    }, 
    "status": 400 
} 

Answer 1

我复制你的问题更简单的查询我的数据。

"query": { 
    "range": { 
     "recent_buy_transaction": { 
      "from": "now-1Y" 
     } 
    } 
} 

我得到了同样的错误。

ElasticSearchParseException[unit [Y] not supported for date math [-1Y]]

然而，使用小ý解决该问题。您正在使用哪个ES版本

now-1y/M

从documentation

The supported time units are: y (year), M (month), w (week), d (day), h (hour), m (minute), and s (second).