fluentd-plugin-elasticseachで突っ込んだアクセスログから昨日1日ぶんのデータを集計するサンプル

es_yesterday_access.rb

#!/usr/local/bin/ruby
require 'time'
require 'pp'
require 'elasticsearch'

def time2index(time); time.utc.strftime('logstash-%Y.%m.%d') end

today = Date.today

start_time = (today - 1).to_time
end_time   = today.to_time - 1
indexes = [ time2index(end_time), time2index(start_time) ]

es = Elasticsearch::Client.new hosts: ['127.0.0.1:9200'], log: true

result = es.count(
  index: indexes,
  body: {
    'filtered' => {
      'query' => {
#        'term' => { 'domain' => "mikeda.jp" },
        'match' => { 'path' => "blog" },
      },
      'filter' => {
        'and' => {
          "filters" => [
            {
              'term' => { "status" => 200 },
            },
            {
              'range' => {
                '@timestamp' => {
                  'from' => start_time.to_i * 1000,
                  'to' => end_time.to_i * 1000
                }
              }
            }
          ]
        }
      }
    }
  }
)

pp result
## => {"count"=>2832, "_shards"=>{"total"=>10, "successful"=>10, "failed"=>0}}