使用Nest,我尝试重现Kibana创建的查询以构建数据表可视化。
这是Kibana创造的:
{
"size": 0,
"aggs": {
"4": {
"date_histogram": {
"field": "BeginDate",
"interval": "1d",
"time_zone": "America/Phoenix",
"min_doc_count": 1
},
"aggs": {
"2": {
"terms": {
"field": "Application.keyword",
"size": 5,
"order": {
"_term": "desc"
}
},
"aggs": {
"3": {
"terms": {
"field": "Module.keyword",
"size": 5,
"order": {
"_term": "desc"
}
},
"aggs": {
"5": {
"terms": {
"field": "SubModule.keyword",
"size": 5,
"order": {
"_count": "desc"
}
}
}
}
}
}
}
}
}
},
"version": true,
"query": {
"bool": {
"must": [
{
"query_string": {
"query": "*",
"analyze_wildcard": true
}
},
{
"range": {
"BeginDate": {
"gte": 1521671201609,
"lte": 1524263201609,
"format": "epoch_millis"
}
}
}
],
"must_not": []
}
}
}
我从Kibana创建的内容中遗漏了一些细节,但我不相信他们会改变回应。
这是我最好的尝试:
var events = Es.Client.Search<Event>(s => s
.Index(Es.AliasName)
.Size(0)
.Aggregations(a1 => a1
.DateHistogram("BeginDate", bd => bd
.Field(f => f.BeginDate)
.Interval(DateInterval.Day)
.TimeZone("UTC")
.MinimumDocumentCount(1)))
.Aggregations(a => a
.Terms("Application", t => t
.Field(f => f.App.Suffix("keyword"))))
.Aggregations(a => a
.Terms("Module", t => t
.Field(f => f.AppModule.Suffix("keyword"))))
.Aggregations(a => a
.Terms("SubModule", t => t
.Field(f => f.AppSubModule.Suffix("keyword"))))
.Version(true)
.Query(q => q
.Bool(b => b
.Must(m => m.QueryString(qs => qs
.Query("*")
.AnalyzeWildcard(true)),
m => m.DateRange(
r => r.Field("BeginDate")
.GreaterThanOrEquals(yesterday2.Date)
.LessThanOrEquals(yesterday.Date.AddTicks(-1).AddDays(1)))))));
我无法弄清楚如何创建聚合聚合。我查看了儿童聚合和嵌套聚合,但这些似乎做了别的事情。我错过了什么?
答案 0 :(得分:0)
知道了,我需要从字段中构建聚合:
var events = Es.Client.Search<Event>(s => s
.Index(Es.AliasName)
.Size(0)
.Aggregations(a1 => a1
.DateHistogram("BeginDate", bd => bd
.Field(f => f.BeginDate)
.Aggregations(a2 => a2
.Terms("Application", app => app
.Field(f => f.App.Suffix("keyword"))
.Aggregations(a3 => a3
.Terms("Module", mod => mod
.Field(f => f.AppModule.Suffix("keyword"))
.Aggregations(a4 => a4
.Terms("SubModule", subm => subm
.Field(f => f.AppSubModule.Suffix("keyword"))