How to do top_hits aggregation after cardinality aggregation?

Elastic Stack Elasticsearch
1

Hello
I need to do top_hits aggregation on the result of cardinality aggregation .
Here is my aggregation:

GET /logstash-2017.08.14/xms_api_station_info/_search?typed_keys
{"size": 0,
"aggregations": {
"uniq_mac": {
"cardinality": {
"field": "stationMacAddress.keyword"
},
"aggregations":{
"device_type":{
"terms": {
"field": "deviceType.keyword",
"size": 10000000,
"order": {
"_count": "desc"
}
},
"aggregations": {
"devic_class": {
"terms": {
"field":"deviceClass.keyword"
},
"aggregations": {
"top_users": {
"top_hits": {
"size": 1
}
}
}
}
}
}
}
}
}
}

But it gives me that.

{
"error": {
"root_cause": [
{
"type": "aggregation_initialization_exception",
"reason": "Aggregator [uniq_mac] of type [cardinality] cannot accept sub-aggregations"
}
],
"type": "aggregation_initialization_exception",
"reason": "Aggregator [uniq_mac] of type [cardinality] cannot accept sub-aggregations"
},
"status": 500
}

Thanks,

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.