Kibana visualization for a nested Cardinality aggregation

Elastic Stack Kibana
#1

Hi,

I'm trying to create a visualization for the following query:

GET _search
{
     "query": {
        "query_string": {
           "query": "distribution.extension.id:org.xwiki.* AND date.since:[1 TO *]"
        }
     },
    "aggs": {
        "activeinstalls_over_time" : {
            "date_histogram" : {
                "field" : "date.current",
                "calendar_interval": "week"
            },
            "aggs" : {
                "instanceId_count" : {
                    "cardinality" : {
                        "field" : "distribution.instanceId"
                    }
                }
            }
        }
    }
}

I've found the "Aggregation-based" visualization type but I can't figure out how to add a nested Cardinality aggregation (nor how to set a query string).

When I try to add a nested aggregation, I don't see a Cardinality sub-aggregation available.

Screenshot 2022-06-15 at 15.47.31
Screenshot 2022-06-15 at 15.47.314396×2016 318 KB

Any idea what I can do? Do I have to learn how to write a custom visualization using Vega?

Thanks!

#2

I believe Lens can make this sort of request automatically. Here's my config -

image
image764×1128 50.6 KB

and the request (which looks similar to yours)

{
  "aggs": {
    "0": {
      "terms": {
        "field": "host.os.name",
        "order": {
          "2": "desc"
        },
        "size": 3
      },
      "aggs": {
        "1": {
          "date_histogram": {
            "field": "@timestamp",
            "fixed_interval": "30s",
            "time_zone": "America/New_York",
            "extended_bounds": {
              "min": 1655304231774,
              "max": 1655305131774
            }
          },
          "aggs": {
            "2": {
              "cardinality": {
                "field": "agent.id"
              }
            }
          }
        },
        "2": {
          "cardinality": {
            "field": "agent.id"
          }
        }
      }
    }
  },
#3

@ghudgins thanks! I think I got it to work simply with the following:

Screenshot 2022-06-16 at 10.57.44
Screenshot 2022-06-16 at 10.57.44860×1202 60.8 KB

#4

hmm thinking about it, I don't think it's correct since I don't see how it would do an aggregation (except for the unique_count which should correspond to the Cardinality aggregation I suppose) :slight_smile:

#5

except for the unique_count which should correspond to the Cardinality aggregation I suppose

Yes - FWIW unique count is cardinality under the hood.