Hi,
I'm trying to use a bucket script to calculate the proportion of total of one of my buckets (query snippet below).
I was getting an error of type "Only sibling pipeline aggregations are allowed at the top level" so I included an outer aggregation with a filter that matches all (found the fix on this forum).
But currently it's not providing any result. Does anybody see any problem with my query? If this script is even possible?
Many thanks!
{
"size": 0,
"query": {
"bool": {
"must": [
{
"match_phrase": {
"url": {
"query": "/oauth/challenge",
"slop": 0,
"zero_terms_query": "NONE",
"boost": 1
}
}
},
{
"match_phrase": {
"useragent.name": {
"query": "familyApp",
"slop": 0,
"zero_terms_query": "NONE",
"boost": 1
}
}
},
{
"match_phrase": {
"web_server": {
"query": "test",
"slop": 0,
"zero_terms_query": "NONE",
"boost": 1
}
}
}
]
}
},
"aggs": {
"all_matching_docs": {
"filters": {
"filters": {
"all": {
"match_all": {}
}
}
},
"aggs": {
"total_attempts": {
"value_count": {
"field": "response_code.keyword"
}
},
"result": {
"filter": {
"term": {
"response_code.keyword": {
"value": "200",
"boost": 1
}
}
}
},
"test_script": {"bucket_script": {
"buckets_path": {
"200": "result>_count",
"total": "total_attempts"
},
"script": "200 / total"
}}
}
}
}
}