how to convert elastic query aggregate filter into nest query in .Net core

Question

How can I convert this Elastic search query into nest query. the query is given Bellow . GET winlogbeat-6.6.0*/_search?size=0

{
  "query": {
    "match_all": {}
  },
  "aggs": {
    "success ": {
      "filter": {
        "term": {
          "event_id": 4624 
        }
      }

    },
    "failed": {
      "filter": {
        "term": {
          "event_id": 4625 
        }
      }
    }
  }
}

The desired out Output in Kibana is as follow

    {
      "took" : 13120,
      "timed_out" : false,
      "_shards" : {
        "total" : 37,
        "successful" : 37,
        "skipped" : 0,
        "failed" : 0
      },
      "hits" : {
        "total" : 299924794,
        "max_score" : 0.0,
        "hits" : [ ]
      },
      "aggregations" : {
        "failed" : {
          "doc_count" : 351643
        },
        "success " : {
          "doc_count" : 40375274
        }
      }
    }

this is my code and i need to convert it NEST to get the desired result . Thanks

var queryWinlogbeat_6_6_0 = _elasticClient.Search<winlogbeat_6_6_0>(q => q .Index("winlogbeat-6.6.0*") .Size(0) .Aggregations(a => a .Filter("Success", fa => fa .Filter(f => f.Term(o => o.event_id, 4624)) ) ) ); This code return me correct record for "success" bucket but how to another filter for "failed" bucked — Nisar Ahmad
– Nisar Ahmad, Commented Aug 6, 2019 at 16:00
@NisarAhmad you can edit a question to add additional detail, like what you have tried so far. This would also allow you to format it — Russ Cam
– Russ Cam, Commented Aug 6, 2019 at 21:21

Rob · Accepted Answer · 2019-08-06 19:26:40Z

1

You are almost there, you just need to add another case by calling .Filter(..) on aggregations descriptor

var searchResponse = await client.SearchAsync<Document>(s => s
    .Query(q => q.MatchAll())
    .Aggregations(a => a
        .Filter("success", success => success
            .Filter(filter => filter
                .Term(t => t.Field(f => f.EventId).Value(4624))))
        .Filter("failed", failed => failed
            .Filter(filter => filter
                .Term(t => t.Field(f => f.EventId).Value(4625))))));

public class Document
{
    public int Id { get; set; }
    public int EventId { get; set; }
}

Hope that helps.

answered Aug 6, 2019 at 19:26

Rob

9,9793 gold badges45 silver badges47 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

how to convert elastic query aggregate filter into nest query in .Net core

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related