Reputation: 1
I have the following kibana watcher with aggregation of the results:
"aggs": {
"group_by_ip": {
"multi_terms": {
"terms": [
{
"field": "request"
},
{
"field": "Message"
},
{
"field": "applicationcluster“
}
]
}
}
If the query returns only one hit, the aggregation bucket seems to be empty.
"result": {
"execution_time": "2024-03-22T10:44:25.407Z",
"execution_duration": 775,
"input": {
"type": "search",
"status": "success",
"payload": {
"_shards": {
"total": 3,
"failed": 0,
"successful": 3,
"skipped": 0
},
"hits": {
"hits": [],
"total": 1,
"max_score": null
},
"took": 17,
"timed_out": false,
"aggregations": {
"group_by_ip": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": []
}
}
}
Is there any way to perform the aggregation even if there´s only one hit? Thanks!
Executing the watcher and aggregation works with one single hit.
Upvotes: 0
Views: 62