專案

一般

配置概況

下載 (1.63 KB)

工作單 #86 » tf_momo_smartfds_month_reject_challenge_rule_group_name.json

marlboro chu, 2025-05-26 03:38

 
{
"source": {
"index": "momo_smartfds_login*",
"query": {
"bool": {
"must": [
{ "exists": { "field": "rule_group_name" } },
{ "terms": { "decision_code": ["reject","challenge"] } }
],
"must_not": [
{ "term": { "rule_group_name": "" } },
{ "term": { "rule_group_name": " " } }
]
}
}
},
"dest": {
"index": "momo_smartfds_month_reject_challenge_rule_group_name"
},
"frequency": "1h",
"sync": {
"time": {
"field": "create_datetime",
"delay": "60s"
}
},
"pivot": {
"group_by": {
"datetime_field": {
"date_histogram": {
"field": "create_datetime",
"calendar_interval": "month"
}
}
},
"aggregations": {
"gn": {
"scripted_metric": {
"init_script": "state.docs = new HashMap();",
"map_script": "if (doc.containsKey('rule_group_name') && doc['rule_group_name'].size() > 0) { def code = doc['rule_group_name'].value; state.docs.put(code, state.docs.getOrDefault(code, 0) + 1); } else { state.docs.put('nullvalue', state.docs.getOrDefault('nullvalue', 0) + 1); }",
"combine_script": "return state.docs;",
"reduce_script": "def result = new HashMap(); for (state in states) { for (entry in state.entrySet()) { result.put(entry.getKey(), result.getOrDefault(entry.getKey(), 0) + entry.getValue()); } } return result;"
}
},
"missing_rule_group_name": {
"cardinality": {
"field": "rule_group_name"
}
},
"total_count": {
"value_count": {
"field": "_id"
}
}
}
}
}

(11-11/12)