组合两个elasticsearch查询

Question

多亏了梦幻般的Kibana前端为我elasticsearch指标，我能够构建一个查询在特定时间跨度拉记录一个小时按小时计：

{ 
    "facets": { 
    "0": { 
     "date_histogram": { 
     "field": "@timestamp", 
     "interval": "1h" 
     }, 
     "global": true, 
     "facet_filter": { 
     "fquery": { 
      "query": { 
      "filtered": { 
       "query": { 
       "query_string": { 
        "query": "*" 
       } 
       }, 
       "filter": { 
       "bool": { 
        "must": [ 
        { 
         "range": { 
         "@timestamp": { 
          "from": "2014-08-01T07:00:00.000Z", 
          "to": "2014-09-01T06:59:59.999Z" 
         } 
         } 
        }, 
        { 
         "fquery": { 
         "query": { 
          "query_string": { 
          "query": "tags:\"solr_search\"" 
          } 
         }, 
         "_cache": true 
         } 
        } 
        ] 
       } 
       } 
      } 
      } 
     } 
     } 
    } 
    }, 
    "size": 0 
}' 

哪让我像输出：

{ 
    "took" : 27, 
    "timed_out" : false, 
    "_shards" : { 
    "total" : 155, 
    "successful" : 155, 
    "failed" : 0 
    }, 
    "hits" : { 
    "total" : 267366, 
    "max_score" : 0.0, 
    "hits" : [ ] 
    }, 
    "facets" : { 
    "0" : { 
     "_type" : "date_histogram", 
     "entries" : [ { 
     "time" : 1406876400000, 
     "count" : 120 
     }, { 
     "time" : 1406880000000, 
     "count" : 115 
     }, { 
     "time" : 1406883600000, 
     "count" : 134 
     }, { 
     "time" : 1406887200000, 
     "count" : 87 
     }, { 
     "time" : 1406890800000, 
     "count" : 99 
     }, { 
     "time" : 1406894400000, 
     "count" : 141 
     }, { 
     "time" : 1406898000000, 
     "count" : 168 
     }, { 
     "time" : 1406901600000, 
     "count" : 300 
     }, { 
     "time" : 1406905200000, 
     "count" : 782 
     }, { 
     "time" : 1406908800000, 
     "count" : 1085 
     }, { 

和（再次使用Kibana的帮助），我可以为一个特定的时间桶，获得最大的搜索术语的前10名名单，像这样的查询：

{ 
    "facets": { 
    "terms": { 
     "terms": { 
     "field": "searchstring.raw", 
     "size": 10, 
     "order": "count", 
     "exclude": [] 
     }, 
     "facet_filter": { 
     "fquery": { 
      "query": { 
      "filtered": { 
       "query": { 
       "bool": { 
        "should": [ 
        { 
         "query_string": { 
         "query": "*" 
         } 
        } 
        ] 
       } 
       }, 
       "filter": { 
       "bool": { 
        "must": [ 
        { 
         "range": { 
         "@timestamp": { 
          "from": 1406876400000, 
          "to": 1406880000000 
         } 
         } 
        }, 
        { 
         "fquery": { 
         "query": { 
          "query_string": { 
          "query": "tags:\"solr_search\"" 
          } 
         }, 
         "_cache": true 
         } 
        } 
        ] 
       } 
       } 
      } 
      } 
     } 
     } 
    } 
    }, 
    "size": 0 
}' 

其中给出的结果是这样的：

{ 
    "took" : 56, 
    "timed_out" : false, 
    "_shards" : { 
    "total" : 155, 
    "successful" : 155, 
    "failed" : 0 
    }, 
    "hits" : { 
    "total" : 267366, 
    "max_score" : 0.0, 
    "hits" : [ ] 
    }, 
    "facets" : { 
    "terms" : { 
     "_type" : "terms", 
     "missing" : 0, 
     "total" : 120, 
     "other" : 86, 
     "terms" : [ { 
     "term" : "term1", 
     "count" : 11 
     }, { 
     "term" : "term2", 
     "count" : 4 
     }, { 
     "term" : "term3", 
     "count" : 3 
     }, { 
     "term" : "term4", 
     "count" : 3 
     }, { 
     "term" : "term5", 
     "count" : 3 
     }, { 
     "term" : "term6", 
     "count" : 2 
     }, { 
     "term" : "term7", 
     "count" : 2 
     }, { 
     "term" : "term8", 
     "count" : 2 
     }, { 
     "term" : "term9", 
     "count" : 2 
     }, { 
     "term" : "term10", 
     "count" : 2 
     } ] 
    } 
    } 
} 

我想什么做的是：在第一查询的输出拉为时间桶的前10项每次桶，把在输出每桶时间为。我对弹性搜索查询语言还比较陌生，迄今为止我在合并这两个查询方面的尝试都在消失。如果任何人有任何指针，我将不胜感激。

Answer 1

我最终放弃了更新聚合语法的方面方法。下面是最终回到什么什么，我一直在寻找：

{ 
    "query": { 
     "filtered": { 
      "filter": { 
       "bool": { 
        "must": [ 
         { 
          "range": { 
           "@timestamp": { 
            "from": "2014-08-01T00:00:00.000Z", 
            "to": "2014-09-01T00:00:00.000Z" 
           } 
          } 
         }, 
         { 
          "fquery": { 
           "query": { 
            "query_string": { 
             "query": "tags:\"solr_search\"" 
            } 
           }, 
           "_cache": true 
          } 
         } 
        ] 
       } 
      } 
     } 
    }, 
    "aggs": { 
     "searches_per_hour": { 
      "date_histogram" : { 
       "field": "@timestamp", 
       "interval": "1h", 
       "format": "yyyy-MM-dd ha" 
      }, 
      "aggs": { 
       "top_search_terms": { 
        "terms": { 
         "field": "searchstring.raw", 
         "size": 10, 
         "shard_size": 300 
        } 
       } 
      } 
     } 
    } 
} 

也许这将缩短别人的作品有朝一日:)