数据像这样，怎么统计出最近半小时 200 ，304 ，400 出现的次数，还可能有其他值 404 ，401 等 es_nginx_access{instance="aliyun-server-2", job="logstash"} 400 es_nginx_access{instance="aliyun-server-2", job="logstash"} 200 es_nginx_access{instance="aliyun-server-2", job="logstash"} 200 es_nginx_access{instance="aliyun-server-2", job="logstash"} 304
This topic created in 1676 days ago, the information mentioned may be changed or developed.
4 replies • 2021-11-02 09:54:14 +08:00
 |
1
lamesbond OP es_nginx_access{instance="aliyun-server-2", job="logstash"} 400
es_nginx_access{instance="aliyun-server-2", job="logstash"} 200 es_nginx_access{instance="aliyun-server-2", job="logstash"} 200 es_nginx_access{instance="aliyun-server-2", job="logstash"} 304 |
|
2
lamesbond OP 用 count_over_time 是把最近半小时所有的结果都加在一起了，用 count_values 的话可以查到不同结果的次数，但不支持时段查询，只能查当前的，很苦恼
|
 |
3
kaikai5601 Nov 2, 2021 via iPhone
加上时间 30m
|
|
4
lamesbond OP 试过用子查询 count_values("count", (es_nginx_access[300m]))，但是报错：Error executing query: invalid parameter "query": 1:23: parse error: expected type instant vector in aggregation expression, got range vector 。count_values 不支持 range vector
|
Select Language