elasticsearch - 将子聚合添加到bucket_selector聚合中

Question

所以我有两个级别的聚合和过滤器聚合名为timestamps_bucket_filter的查询

{
  "size": 0,
  "aggregations": {
    "colors": {
      "terms": {
        "field": "color"
      },
      "aggregations": {
        "timestamps": {
          "date_histogram": {
            "field": "timestamp",
            "interval": "1m",
            "order": {
              "_key": "desc"
            }
          },
          "aggregations": {
            "timestamps_bucket_filter": {
              "bucket_selector": {
                "buckets_path": {
                  "counterts": "_count"
                },
                "script": {
                  "lang": "expression",
                  "script": "counterts <= 50"
                }
              }
            }
          }
        }
      }
    }
  }
}

现在，我想做的是在 timestamps_bucket_filter下添加另一个子聚合，类似:

{
  "size": 0,
  "aggregations": {
    "colors": {
      "terms": {
        "field": "color"
      },
      "aggregations": {
        "timestamps": {
          "date_histogram": {
            "field": "timestamp",
            "interval": "1m",
            "order": {
              "_key": "desc"
            }
          },
          "aggregations": {
            "timestamps_bucket_filter": {
              "bucket_selector": {
                "buckets_path": {
                  "counterts": "_count"
                },
                "script": {
                  "lang": "expression",
                  "script": "counterts <= 50"
                }
              },
              "aggregations": {                <-- I would like to add this aggregation
                "name": {
                  "terms": {
                    "field": "name"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

不幸的是，我得到 Aggregation [timestamps_bucket_filter] cannot define sub-aggregations
有没有解决该障碍的方法。我真的需要在我创建的过滤器脚本下获得这些名称。

提前致谢。

Answer 1

这似乎是一个缺陷。文档的新手声称完全相反:

The interesting part comes next. Since each bucket effectively defines a document set (all documents belonging to the bucket), one can potentially associate aggregations on the bucket level, and those will execute within the context of that bucket. This is where the real power of aggregations kicks in: aggregations can be nested!

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations.html