elasticsearch_dsl:聚合生成多个buckets

Question

我想生成以下代码：

GET /packets-2017-09-25/_search
{
  "size": 0,
  "query": {
        "match": {
            "transport_protocol": "tcp"
        }
  },
  "aggs": {
    "clients": {
      "terms": {
        "field": "layers.ip.src.keyword",
        "size": 1000,
        "order":{ "num_servers.value":"desc" }
      },
      "aggs": {
        "num_servers": {
          "cardinality": {
            "field": "layers.ip.dst.keyword",
            "precision_threshold" : 40000
          } 
        },
        "server_list": {
          "terms": {
            "field": "layers.ip.dst.keyword"
          }
        }
      }
    }
  }
}

也就是说，我想要客户端下面的两个存储桶(num_servers)和(server_list)。

我正在尝试下面这段代码，它会出错：

def get_streams_per_client(proto='tcp', max=40000):
    s = Search(using=client, index="packets-2017-09-25") \
               .query("match", transport_protocol=proto)
    s.aggs.bucket('clients', 'terms', field='layers.ip.src.keyword', size=max, order={"num_servers.value":"desc"})\
    .bucket('num_servers', 'cardinality', field='layers.ip.dst.keyword', precision_threshold=40000)\
    .bucket('server_list', 'terms', field='layers.ip.dst.keyword')
    s = s.execute()
    <snip>

我想我错过了正确的语法。感谢一些指导。

Answer 1

如果您想定义其他子聚合，则始终可以使用["name"]表示法到达现有聚合：

s = Search().query('match', transport_protocol='tcp')
s.aggs.bucket('clients', 'terms', field='layers.ip.src.keyword', size=max, order={"num_servers.value":"desc"})
s.aggs['clients'].metric('num_servers', 'cardinality', field=..., precision_threshold=...)
s.aggs['clients'].bucket('server_list', 'terms', ...)

希望这能有所帮助！

Answer 2

在elasticsearch_dsl项目页面上得到了来自Honza的答案：

  s = Search(using=client, index="packets-2017-09-25").query('match', transport_protocol=proto)
  s.aggs.bucket('clients', 'terms', field='layers.ip.src.keyword', size=max, order={"num_servers.value":"desc"})
  s.aggs['clients'].bucket('num_servers', 'cardinality', field='layers.ip.dst.keyword', precision_threshold=40000)
  s.aggs['clients'].bucket('server_list', 'terms', field='layers.ip.dst.keyword')
  print json.dumps(s.to_dict(), indent=4)
  s = s.execute()