ElasticSearch NEST 聚合子桶查询答案

【问题标题】：ElasticSearch NEST Aggregate SubBucket QueryElasticSearch NEST 聚合子桶查询
【发布时间】：2018-10-01 16:50:46
【问题描述】：

使用 Nest，我正在尝试重现 Kibana 为构建数据表可视化而创建的查询。

这是 Kibana 创建的：

    {
      "size": 0,
      "aggs": {
        "4": {
          "date_histogram": {
            "field": "BeginDate",
            "interval": "1d",
            "time_zone": "America/Phoenix",
            "min_doc_count": 1
          },
          "aggs": {
            "2": {
              "terms": {
                "field": "Application.keyword",
                "size": 5,
                "order": {
                  "_term": "desc"
                }
              },
              "aggs": {
                "3": {
                  "terms": {
                    "field": "Module.keyword",
                    "size": 5,
                    "order": {
                      "_term": "desc"
                    }
                  },
                  "aggs": {
                    "5": {
                      "terms": {
                        "field": "SubModule.keyword",
                        "size": 5,
                        "order": {
                          "_count": "desc"
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      },
      "version": true,
      "query": {
        "bool": {
          "must": [
            {
              "query_string": {
                "query": "*",
                "analyze_wildcard": true
              }
            },
            {
              "range": {
                "BeginDate": {
                  "gte": 1521671201609,
                  "lte": 1524263201609,
                  "format": "epoch_millis"
                }
              }
            }
          ],
          "must_not": []
        }
      }
    }

我遗漏了 Kibana 创建的一些细节，但我不相信他们会改变响应。

这是我最好的尝试：

        var events = Es.Client.Search<Event>(s => s
        .Index(Es.AliasName)
        .Size(0)            
            .Aggregations(a1 => a1 
                .DateHistogram("BeginDate", bd => bd
                    .Field(f => f.BeginDate)
                    .Interval(DateInterval.Day)
                    .TimeZone("UTC")
                    .MinimumDocumentCount(1)))
                .Aggregations(a => a
                    .Terms("Application", t => t
                    .Field(f => f.App.Suffix("keyword"))))
                    .Aggregations(a => a
                        .Terms("Module", t => t
                        .Field(f => f.AppModule.Suffix("keyword"))))
                            .Aggregations(a => a
                                .Terms("SubModule", t => t
                                .Field(f => f.AppSubModule.Suffix("keyword"))))
            .Version(true)
            .Query(q => q
               .Bool(b => b
                   .Must(m => m.QueryString(qs => qs
                           .Query("*")
                           .AnalyzeWildcard(true)),
                         m => m.DateRange(
                            r => r.Field("BeginDate")
                            .GreaterThanOrEquals(yesterday2.Date)
                            .LessThanOrEquals(yesterday.Date.AddTicks(-1).AddDays(1)))))));

我不知道如何创建聚合的聚合。我研究了儿童聚合和嵌套聚合，但这些似乎做了别的事情。我错过了什么？

【问题讨论】：

标签： elasticsearch elasticsearch-5 elasticsearch-net

【解决方案1】：

知道了，我需要从字段中构建聚合：

        var events = Es.Client.Search<Event>(s => s
        .Index(Es.AliasName)
        .Size(0)            
            .Aggregations(a1 => a1 
                .DateHistogram("BeginDate", bd => bd
                    .Field(f => f.BeginDate)
                        .Aggregations(a2 => a2
                            .Terms("Application", app => app
                            .Field(f => f.App.Suffix("keyword"))
                                .Aggregations(a3 => a3
                                    .Terms("Module", mod => mod
                                    .Field(f => f.AppModule.Suffix("keyword"))
                                        .Aggregations(a4 => a4
                                            .Terms("SubModule", subm => subm
                                            .Field(f => f.AppSubModule.Suffix("keyword"))

【讨论】：