Which elasticsearch aggregations should I use?

问题

I need to create a bar chart of "number of active users by date". An active user means the user who has logged in last 7 days. so I need to count total number of users, whose last_activity date is within 7 last days. and I need to do it for each bar(day) in my chart.

I understand it needs to be done using aggregations elastic search, but unsure

which aggregations should I use? bucket aggregations, pipeline aggregations?

Please let me know if you know a similar example of it.

Here you can find two examples of sample documents for user "john"

{
    "userid": "john",
    "last_activity": "2017-08-09T16:10:10.396+01:00",
    "date_of_this_report": "2017-09-24T00:00:00+01:00"
}


{
    "userid": "john",
    "last_activity": "2017-08-09T16:10:10.396+01:00",
    "date_of_this_report": "2017-09-25T00:00:00+01:00"
}

回答1:

You can filter the users with last activity for last 7 days using date math operation of elasticsearch. You can push the filter before the date histogram aggregation.

POST active_users/document_type1/_search
{
  "size": 0, 
  "aggs": {
    "filtered_active_users_7_days": {
      "filter": {
        "range": {
          "last_activity": {
            "gte": "now-7d/d"
          }
        }
      },
      "aggs": {
        "date_histogram_last_7_days": {
          "date_histogram": {
            "field": "last_activity",
            "interval": "day"
          }
        }
      }
    }
  }
}

Hope this works for you.

来源：https://stackoverflow.com/questions/46603723/which-elasticsearch-aggregations-should-i-use