I wrote an aggregation, and it meets my requirements, but I also need to add a field (trace.id) when the results are displayed. Trace.id does not need to be aggregated.
How should dsl be written in this case?
Can anyone help
POST apm-7.8.1-transaction-000012/_search
{
"size": 0,
"aggs": {
"range": {
"date_range": {
"field": "date",
"format": "MM-yyyy",
"ranges": [
{
"to": "now-10M/M"
},
{
"from": "now-10M/M"
}
]
}
},
"service_name": {
"terms": {
"field": "service.name"
},
"aggs": {
"url_path": {
"terms": {
"field": "url.path",
"order": [
{
"transaction_duration_us": "desc"
}
],
"size": 10
},
"aggs": {
"transaction_duration_us": {
"avg": {
"field": "transaction.duration.us"
}
}
}
}
}
}
}
}