gpt4 book ai didi

elasticsearch-dsl - elasticsearch_dsl : Generate multiple buckets in aggregation

转载 作者:行者123 更新时间:2023-12-04 15:00:24 25 4
gpt4 key购买 nike

我想生成这个:

GET /packets-2017-09-25/_search
{
"size": 0,
"query": {
"match": {
"transport_protocol": "tcp"
}
},
"aggs": {
"clients": {
"terms": {
"field": "layers.ip.src.keyword",
"size": 1000,
"order":{ "num_servers.value":"desc" }
},
"aggs": {
"num_servers": {
"cardinality": {
"field": "layers.ip.dst.keyword",
"precision_threshold" : 40000
}
},
"server_list": {
"terms": {
"field": "layers.ip.dst.keyword"
}
}
}
}
}
}

即我想要两个存储桶 (num_servers) 和 (server_list) 在客户端下。

我正在尝试下面的代码,但出现错误:

def get_streams_per_client(proto='tcp', max=40000):
s = Search(using=client, index="packets-2017-09-25") \
.query("match", transport_protocol=proto)
s.aggs.bucket('clients', 'terms', field='layers.ip.src.keyword', size=max, order={"num_servers.value":"desc"})\
.bucket('num_servers', 'cardinality', field='layers.ip.dst.keyword', precision_threshold=40000)\
.bucket('server_list', 'terms', field='layers.ip.dst.keyword')
s = s.execute()
<snip>

我认为我缺少正确的语法。感谢一些指导。

最佳答案

如果您想定义其他子聚合,您始终可以使用 ["name"] 表示法达到现有聚合:

s = Search().query('match', transport_protocol='tcp')
s.aggs.bucket('clients', 'terms', field='layers.ip.src.keyword', size=max, order={"num_servers.value":"desc"})
s.aggs['clients'].metric('num_servers', 'cardinality', field=..., precision_threshold=...)
s.aggs['clients'].bucket('server_list', 'terms', ...)

希望这会有所帮助!

关于elasticsearch-dsl - elasticsearch_dsl : Generate multiple buckets in aggregation,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/47346959/

25 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com