数据像这样，怎么统计出最近半小时 200 ，304 ，400 出现的次数，还可能有其他值 404 ，401 等 es_nginx_access{instance="aliyun-server-2", job="logstash"} 400 es_nginx_access{instance="aliyun-server-2", job="logstash"} 200 es_nginx_access{instance="aliyun-server-2", job="logstash"} 200 es_nginx_access{instance="aliyun-server-2", job="logstash"} 304
This topic created in 1658 days ago, the information mentioned may be changed or developed.
4 replies 2021-11-02 09:54:14 +08:00
 | 1 lamesbond OP es_nginx_access{instance="aliyun-server-2", job="logstash"} 400 es_nginx_access{instance="aliyun-server-2", job="logstash"} 200 es_nginx_access{instance="aliyun-server-2", job="logstash"} 200 es_nginx_access{instance="aliyun-server-2", job="logstash"} 304 |
| 2 lamesbond OP 用 count_over_time 是把最近半小时所有的结果都加在一起了，用 count_values 的话可以查到不同结果的次数，但不支持时段查询，只能查当前的，很苦恼 |
 | 3 kaikai5601 Nov 2, 2021 via iPhone 加上时间 30m |
| 4 lamesbond OP 试过用子查询 count_values("count", (es_nginx_access[300m]))，但是报错：Error executing query: invalid parameter "query": 1:23: parse error: expected type instant vector in aggregation expression, got range vector 。count_values 不支持 range vector |
Select Language