增加频次过滤

zhangqian

2024-12-12 e012f2c5e7c6bc79277ff3317efae7d952a18d22

 models/gather_model.go

@@ -227,6 +227,19 @@
                                             },
                                          },
                                       },
                                       "frequency_filter": map[string]interface{}{ // 添加频率过滤
                                          "bucket_selector": map[string]interface{}{
                                             "buckets_path": map[string]interface{}{
                                                "eventCount": "_count", // 聚合事件次数
                                             },
                                             "script": map[string]interface{}{
                                                "source": "params.eventCount >= params.threshold", // 筛选频率达到阈值的事件
                                                "params": map[string]interface{}{
                                                   "threshold": gatherModel.Threshold,
                                                },
                                             },
                                          },
                                       },
                                    },
                                 },
                              },
@@ -294,7 +307,7 @@
                              if gatherEvents, ok := floorBucket.(map[string]interface{})["gather_events"].(map[string]interface{})["buckets"].([]interface{}); ok {
                                 for _, eventBucket := range gatherEvents {
                                    key := int64(eventBucket.(map[string]interface{})["key"].(float64)) / 1000 // 将毫秒转换为秒
                                    timestamp := time.Unix(key, 0).Format("2006-01-02T15:04:05")
                                    timestamp := time.Unix(key, 0).Format("2006-01-02 15:04:05")

                                    // 解析人员
                                    if peopleBuckets, ok := eventBucket.(map[string]interface{})["people"].(map[string]interface{})["buckets"].([]interface{}); ok {