(field, limit=10, query='', query_dsl='')
return {
        'query': query_filter,
        'aggs': {
            'aggregation': {
                'terms': {
                    'field': field,
                    'size': limit
                }
            }
        }
    }
Returns aggregation specs for a term of filtered events.

    The aggregation spec will summarize values of an attribute
    whose events fall under a filter.

    Args:
        field (str): this denotes the event attribute that is used
            for aggregation.
        limit (int): How many buckets to return, defaults to 10.
        query (str): the query field to run on all documents prior to
            aggregating the results.
        query_dsl (str): the query DSL field to run on all documents prior
            to aggregating the results (optional). Either a query string
            or a query DSL has to be present.

    Raises:
        ValueError: if neither query_string or query_dsl is provided.

    Returns:
        a dict value that can be used as an aggregation spec.
Returns aggregation specs for a term of filtered events.
Returns aggregation specs for a term of filtered events .
def get_spec(field, limit=10, query='', query_dsl=''):
    """Returns aggregation specs for a term of filtered events.

    The aggregation spec will summarize values of an attribute
    whose events fall under a filter.

    Args:
        field (str): this denotes the event attribute that is used
            for aggregation.
        limit (int): How many buckets to return, defaults to 10.
        query (str): the query field to run on all documents prior to
            aggregating the results.
        query_dsl (str): the query DSL field to run on all documents prior
            to aggregating the results (optional). Either a query string
            or a query DSL has to be present.

    Raises:
        ValueError: if neither query_string or query_dsl is provided.

    Returns:
        a dict value that can be used as an aggregation spec.
    """
    if query:
        query_filter = {
            'bool': {
                'must': [
                    {
                        'query_string': {
                            'query': query
                        }
                    }
                ]
            }
        }
    elif query_dsl:
        query_filter = query_dsl
    else:
        raise ValueError('Neither query nor query DSL provided.')


    return {
        'query': query_filter,
        'aggs': {
            'aggregation': {
                'terms': {
                    'field': field,
                    'size': limit
                }
            }
        }
    }
def get_spec ( field , limit = 10 , query = '' , query_dsl = '' ) : if query : query_filter = { 'bool' : { 'must' : [ { 'query_string' : { 'query' : query } } ] } } elif query_dsl : query_filter = query_dsl else : raise ValueError ( 'Neither query nor query DSL provided.' ) return { 'query' : query_filter , 'aggs' : { 'aggregation' : { 'terms' : { 'field' : field , 'size' : limit } } } }