查询以查找给定小时范围内的平均条目数

Question

我有以下给出的查询应该查找给定小时范围内的平均条目数，即从15:00到16:00。

此查询工作不正常。我如何指定小时范围（无日期）并查找每个范围内的平均入场人数？

POST /myindex/_search 
{ 
    "size": 0, 
    "query": { 
    "bool": { 
     "filter": [ 
     {"term": {"EventId": "11"}}, 
     {"term": {"EventType": "Type1"}} 
     ] 
    } 
    }, 
    "aggs": { 
    "range": { 
     "date_range": { 
      "field": "Datetime", 
      "ranges": [ 
       { 
        "from": "16:00-1H/H", 
        "to": "16:00/H" 
       } 
      ] 
     } 
    } 
    } 
} 

我应该使用移动平均值吗？怎么样？

我试过这个，但是我很感谢有人能帮我完成这个查询。我不知道"value_count" : { "field" : "EventHour"}是否是计算条目数量的正确方法。我怎样才能正确地添加小时的范围在此查询？：

POST /myindex/_search 
    { 
     "size": 0, 
     "query": { 
     "bool": { 
      "filter": [ 
      {"term": {"EventId": "11"}}, 
      {"term": {"EventType": "Type1"}}, 
{ 
      "script": { 
      "script": "doc.date.date.getHourOfDay() >= min && doc.date.date.getHourOfDay() <= max", 
      "params": { 
       "min": 15, 
       "max": 16 
      } 
      } 
     } 
      ] 
     } 
     }, 
     "aggs": { 
     "hourly_intensity": { 
      "date_histogram": { 
      "field": "Datetime", 
      "interval": "hour" 
      }, 
      "aggs": { 
      "count_of_events": { 
       "value_count" : { "field" : "EventHour"} 
      } 
      } 
     }, 
     "hourly_avg_count": { 
      "avg_bucket": { 
      "buckets_path": "hourly_intensity>count_of_events" 
      } 
     } 
     } 
    } 

Answer 1

我找到了自己的解决方案：

POST /myindex/_search 
    { 
     "size": 0, 
     "query": { 
     "bool": { 
      "filter": [ 
      {"term": {"EventId": "11"}}, 
      {"term": {"EventType": "Type1"}}, 
      {"term": {"EventHour": 15}} 
      ] 
     } 
     }, 
     "aggs": { 
     "hourly_intensity": { 
      "date_histogram": { 
      "field": "Datetime", 
      "interval": "hour" 
      }, 
      "aggs": { 
      "count_of_events": { 
       "value_count" : { "field" : "EventHour"} 
      } 
      } 
     }, 
     "avg_num_events_per_hour": { 
      "avg_bucket": { 
      "buckets_path": "hourly_intensity>count_of_events" 
      } 
     } 
     } 
}