弹性嵌套不允许我创建多个聚合

relj7zay  于 2021-06-15  发布在  ElasticSearch
关注(0)|答案(1)|浏览(243)

通过使用kibana,我能够制作一些很好的图形,我正在尝试将其转换为nest。来自kibana的json请求如下所示:

{
    "aggs": {
        "2": {
            "date_histogram": {
                "field": "@timestamp",
                "fixed_interval": "30m",
                "min_doc_count": 1
            },
            "aggs": {
                "1": {
                    "cardinality": {
                        "field": "clientip"
                    }
                }
            }
        }
    }

我的窝是这样的:

query.Aggregations(aggs => aggs
    .DateHistogram("total_count", d => d
        .Field(f => f.Timestamp)
        .FixedInterval("30m")
        .MinimumDocumentCount(1)
    )
    .Cardinality("unique_count", c => c
        .Field(f => f.ClientIp)
    )
)

但是,生成的json如下所示:

{
    "aggs": {
        "total_count": {
            "date_histogram": {
                "field": "@timestamp",
                "fixed_interval": "30m",
                "min_doc_count": 1
            }
        },
        "unique_count": {
            "cardinality": {
                "field": "clientip"
            }
        }
    }

这是有道理的,因为这是我在代码里写的。但是,我需要添加 cardinalitydate_histogram ,但我想不通。我不能再加一个 .Aggregations().DateHistogram() ,因为它不存在。
我做错什么了?

xdnvmnnf

xdnvmnnf1#

这应该起作用:

query.Aggregations(aggs => aggs
    .DateHistogram("total_count", d => d
        .Field(f => f.Timestamp)
        .FixedInterval("30m")
        .MinimumDocumentCount(1)
        .Aggregations(childAggs => childAggs
           .Cardinality("unique_count", c => c
             .Field(f => f.ClientIp)
           )
        )
    )
)

相关问题