I am struggling to get an aggregated response based on a query... for example, in Kibana visualization, after creating a table with the aggregations and query I need, I can view the request by going inside the visualization and Inspect -> View:Requests -> Request. This gives me the entire request, structured like this:
How can i obtain the same dataset that is displayed in Kibana Visualization with the API?
I tried translating the API Request fields to the es.search() function like this:
But the data is not aggregated correctly, like in the Kibana Visualization.
Another strange behaviour is that if i completely remove the aggs = {...} from es.search(), it gives me the same dataset.
And the documents are in the hits list, without any kind of aggregation applied.
This aggregation is supposed to group source and destination ip's and sum their packets and bytes.
This is the format of the data displayed in Kibana after applying the aggregations and this is the result I need (either json or csv or whatever as long as I manage to get this)
Top values of source.ip
The request seems correct. The parameter for the request is indeed called aggs, and the ES will return aggregations under aggregations section of the response. Please note that this will be separate from the hits section. So you should have something like this in your ES response:
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.