在 Kibana 中使用 ElasticSearch 查询 DSL 从字段中获取唯一数据

Question

I have already various queries that collect data and show it in the Kibana dashboard. Now I would like to get unique values from my result data. How can I write the query DSL for that.

Basically I would like to get unique value for the field contextMap.connectionid. Is there a way do achieve that using something similar to this example?

{
  "query": {
    "bool": {
      "must": [
        {
          "nested": {
            "path": "app",
            "query": {
              "bool": {
                "must": [
                  {
                    "match": {
                      "app.key": "contextMap.connectionid"
                    }
                  }
                ]
              }
            }
          }
        }
      ]
    }
  }
}

Answer 1

You can calculate distinct count with the help of aggregation. So, your search query is:

Search Query:

{
    "query": {
    "bool": {
      "must": [
        {
          "nested": {
            "path": "app",
            "query": {
              "bool": {
                "must": [
                  {
                    "match": {
                      "app.key": "contextMap.connectionid"
                    }
                  }
                ]
              }
            }
          }
        }
      ]
    }
  },
    "aggs": {
        "uniqueconnectionId": {
            "terms": {
                "field": "contextMap.connectionid.keyword"
            }
        }
    }
}

You can refer here for calculating distinct values of a field https://discuss.elastic.co/t/get-distinct-values-from-a-field-in-elasticsearch/99783