Need to convert dsl query to NEST

Elastic Stack Elasticsearch
1

I have dsl following query
get /metricbeat*/_search?pretty=true
{
"aggs": {
"3": {
"terms": {
"field": "metricset.name",
"order": {
"_count": "desc"
},
"size": 20
}
}
},
"size": 0,
"_source": {
"excludes":
},
"stored_fields": [
"*"
],
"script_fields": {},
"docvalue_fields": [
{
"field": "@timestamp",
"format": "date_time"
},
{
"field": "ceph.monitor_health.last_updated",
"format": "date_time"
},
{
"field": "docker.container.created",
"format": "date_time"
},
{
"field": "docker.healthcheck.event.end_date",
"format": "date_time"
},
{
"field": "docker.healthcheck.event.start_date",
"format": "date_time"
},
{
"field": "docker.image.created",
"format": "date_time"
},
{
"field": "event.created",
"format": "date_time"
},
{
"field": "event.end",
"format": "date_time"
},
{
"field": "event.start",
"format": "date_time"
},
{
"field": "file.accessed",
"format": "date_time"
},
{
"field": "file.created",
"format": "date_time"
},
{
"field": "file.ctime",
"format": "date_time"
},
{
"field": "file.mtime",
"format": "date_time"
},
{
"field": "kubernetes.container.start_time",
"format": "date_time"
},
{
"field": "kubernetes.event.metadata.timestamp.created",
"format": "date_time"
},
{
"field": "kubernetes.event.timestamp.first_occurrence",
"format": "date_time"
},
{
"field": "kubernetes.event.timestamp.last_occurrence",
"format": "date_time"
},
{
"field": "kubernetes.node.start_time",
"format": "date_time"
},
{
"field": "kubernetes.pod.start_time",
"format": "date_time"
},
{
"field": "kubernetes.system.start_time",
"format": "date_time"
},
{
"field": "mongodb.replstatus.server_date",
"format": "date_time"
},
{
"field": "mongodb.status.background_flushing.last_finished",
"format": "date_time"
},
{
"field": "mongodb.status.local_time",
"format": "date_time"
},
{
"field": "nats.server.time",
"format": "date_time"
},
{
"field": "php_fpm.pool.start_time",
"format": "date_time"
},
{
"field": "php_fpm.process.start_time",
"format": "date_time"
},
{
"field": "postgresql.activity.backend_start",
"format": "date_time"
},
{
"field": "postgresql.activity.query_start",
"format": "date_time"
},
{
"field": "postgresql.activity.state_change",
"format": "date_time"
},
{
"field": "postgresql.activity.transaction_start",
"format": "date_time"
},
{
"field": "postgresql.bgwriter.stats_reset",
"format": "date_time"
},
{
"field": "postgresql.database.stats_reset",
"format": "date_time"
},
{
"field": "process.start",
"format": "date_time"
},
{
"field": "system.process.cpu.start_time",
"format": "date_time"
},
{
"field": "zookeeper.server.version_date",
"format": "date_time"
}
],
"query": {
"bool": {
"must": ,
"filter": [
{
"match_all": {}
},
{
"range": {
"@timestamp": {
"format": "strict_date_optional_time",
"gte": "2020-01-08T06:42:50.621Z",
"lte": "2020-01-08T06:57:50.621Z"
}
}
}
],
"should": ,
"must_not":
}
}
}

I want to convert it to NEST. I tried like this but it now return empty

var elasticResponse =

            elasticClient.Search<object>(s => s

            .Aggregations(ag => ag.Terms("metricset.name", tr => tr.Order(o => o.Descending("_count"))))

            .Size(0)

            .DocValueFields(dvf => dvf.Fields(systemFields))

            .Query(q => q.Bool(bl => bl.Filter(fl => fl.Range(r => r.Field("@timestamp").GreaterThan(dd)))))

            );

I kept all DocValueFields in a string array.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.