将子聚合添加到bucket_selector聚合

时间:2016-08-01 12:04:32

标签: elasticsearch aggregation

所以我有两个级别的聚合和过滤器聚合名为timestamps_bucket_filter

的查询
{
  "size": 0,
  "aggregations": {
    "colors": {
      "terms": {
        "field": "color"
      },
      "aggregations": {
        "timestamps": {
          "date_histogram": {
            "field": "timestamp",
            "interval": "1m",
            "order": {
              "_key": "desc"
            }
          },
          "aggregations": {
            "timestamps_bucket_filter": {
              "bucket_selector": {
                "buckets_path": {
                  "counterts": "_count"
                },
                "script": {
                  "lang": "expression",
                  "script": "counterts <= 50"
                }
              }
            }
          }
        }
      }
    }
  }
}

现在,我想要做的是在timestamps_bucket_filter下添加另一个子聚合,例如:

{
  "size": 0,
  "aggregations": {
    "colors": {
      "terms": {
        "field": "color"
      },
      "aggregations": {
        "timestamps": {
          "date_histogram": {
            "field": "timestamp",
            "interval": "1m",
            "order": {
              "_key": "desc"
            }
          },
          "aggregations": {
            "timestamps_bucket_filter": {
              "bucket_selector": {
                "buckets_path": {
                  "counterts": "_count"
                },
                "script": {
                  "lang": "expression",
                  "script": "counterts <= 50"
                }
              },
              "aggregations": {                <-- I would like to add this aggregation
                "name": {
                  "terms": {
                    "field": "name"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

不幸的是,我收到了Aggregation [timestamps_bucket_filter] cannot define sub-aggregations

是否有针对该障碍的解决方法。我真的需要在我创建的过滤器脚本下获取这些名称。

提前致谢。

1 个答案:

答案 0 :(得分:0)

这似乎是一个缺陷。新手阅读文档声称完全相反:

  

接下来是有趣的部分。由于每个存储桶有效地定义了一个文档集(属于该存储桶的所有文档),因此可以在存储桶级别上关联聚合,并且这些聚合将在该存储桶的上下文中执行。这就是聚合的真正力量所在:聚合可以嵌套!

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations.html