(self, sketch_id, indices)
return labels
Aggregate labels for a sketch.

        Args:
            sketch_id: The Sketch ID
            indices: List of indices to aggregate on

        Returns:
            List with label names.
Aggregate labels for a sketch.
Aggregate labels for a sketch .
def get_filter_labels(self, sketch_id, indices):
        """Aggregate labels for a sketch.

        Args:
            sketch_id: The Sketch ID
            indices: List of indices to aggregate on

        Returns:
            List with label names.
        """
        # This is a workaround to return all labels by setting the max buckets
        # to something big. If a sketch has more than this amount of labels
        # the list will be incomplete but it should be uncommon to have >10k
        # labels in a sketch.
        max_labels = 10000

        # pylint: disable=line-too-long
        aggregation = {
            'aggs': {
                'nested': {
                    'nested': {
                        'path': 'timesketch_label'
                    },
                    'aggs': {
                        'inner': {
                            'filter': {
                                'bool': {
                                    'must': [{
                                        'term': {
                                            'timesketch_label.sketch_id': sketch_id
                                        }
                                    }]
                                }
                            },
                            'aggs': {
                                'labels': {
                                    'terms': {
                                        'size': max_labels,
                                        'field': 'timesketch_label.name.keyword'
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }

        # Make sure that the list of index names is uniq.
        indices = list(set(indices))

        labels = []
        # pylint: disable=unexpected-keyword-arg
        try:
            result = self.client.search(
                index=indices, body=aggregation, size=0)
        except NotFoundError:
            es_logger.error('Unable to find the index/indices: {0:s}'.format(
                ','.join(indices)))
            return labels

        buckets = result.get(
            'aggregations', {}).get('nested', {}).get('inner', {}).get(
                'labels', {}).get('buckets', [])

        for bucket in buckets:
            new_bucket = {}
            new_bucket['label'] = bucket.pop('key')
            new_bucket['count'] = bucket.pop('doc_count')
            labels.append(new_bucket)
        return labels
def get_filter_labels ( self , sketch_id , indices ) : # This is a workaround to return all labels by setting the max buckets # to something big. If a sketch has more than this amount of labels # the list will be incomplete but it should be uncommon to have >10k # labels in a sketch. max_labels = 10000 # pylint: disable=line-too-long aggregation = { 'aggs' : { 'nested' : { 'nested' : { 'path' : 'timesketch_label' } , 'aggs' : { 'inner' : { 'filter' : { 'bool' : { 'must' : [ { 'term' : { 'timesketch_label.sketch_id' : sketch_id } } ] } } , 'aggs' : { 'labels' : { 'terms' : { 'size' : max_labels , 'field' : 'timesketch_label.name.keyword' } } } } } } } } # Make sure that the list of index names is uniq. indices = list ( set ( indices ) ) labels = [ ] # pylint: disable=unexpected-keyword-arg try : result = self . client . search ( index = indices , body = aggregation , size = 0 ) except NotFoundError : es_logger . error ( 'Unable to find the index/indices: {0:s}' . format ( ',' . join ( indices ) ) ) return labels buckets = result . get ( 'aggregations' , { } ) . get ( 'nested' , { } ) . get ( 'inner' , { } ) . get ( 'labels' , { } ) . get ( 'buckets' , [ ] ) for bucket in buckets : new_bucket = { } new_bucket [ 'label' ] = bucket . pop ( 'key' ) new_bucket [ 'count' ] = bucket . pop ( 'doc_count' ) labels . append ( new_bucket ) return labels