Answer the question
In order to leave comments, you need to log in
How to use bucket_selector filtering results as a filter in elasticsearch?
elasticsearch has a log index.
I make a request with aggregation and subsequent filtering using bucket_selector
(we need the IDs of applications that sent "event1" but did not send "event2").
I get a list of id like this:
{
"took" : 77,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 3882,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"instance_id" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : 3624,
"doc_count" : 1,
"download" : {
"doc_count" : 1,
"unique_count" : {
"value" : 1
}
},
"launch" : {
"doc_count" : 0,
"unique_count" : {
"value" : 0
}
}
},
{
"key" : 3619,
"doc_count" : 1,
"download" : {
"doc_count" : 1,
"unique_count" : {
"value" : 1
}
},
"launch" : {
"doc_count" : 0,
"unique_count" : {
"value" : 0
}
}
},
...
{
"key" : 3388,
"doc_count" : 1,
"download" : {
"doc_count" : 1,
"unique_count" : {
"value" : 1
}
},
"launch" : {
"doc_count" : 0,
"unique_count" : {
"value" : 0
}
}
}
]
}
}
}
{
"query": {
"bool": {
"must": [
{"terms":{"instance_id": [3624, 3619, ..., 3388]}},
{"term":{"name": "download"}}
]
}
}
}
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question