(
            self, field, query_string='', query_dsl='',
            supported_charts='table', start_time='', end_time='', limit=10)
return interface.AggregationResult(
            encoding=encoding, values=values, chart_type=supported_charts,
            sketch_url=self._sketch_url, field=field,
            extra_query_url=extra_query_url)
Run the aggregation.

        Args:
            field (str): this denotes the event attribute that is used
                for aggregation.
            query_string (str): the query field to run on all documents prior to
                aggregating the results.
            query_dsl (str): the query DSL field to run on all documents prior
                to aggregating the results. Either a query string or a query
                DSL has to be present.
            supported_charts: Chart type to render. Defaults to table.
            start_time: Optional ISO formatted date string that limits the time
                range for the aggregation.
            end_time: Optional ISO formatted date string that limits the time
                range for the aggregation.
            limit (int): How many buckets to return, defaults to 10.

        Returns:
            Instance of interface.AggregationResult with aggregation result.

        Raises:
            ValueError: if neither query_string or query_dsl is provided.
Run the aggregation.
Run the aggregation .
def run(
            self, field, query_string='', query_dsl='',
            supported_charts='table', start_time='', end_time='', limit=10):
        """Run the aggregation.

        Args:
            field (str): this denotes the event attribute that is used
                for aggregation.
            query_string (str): the query field to run on all documents prior to
                aggregating the results.
            query_dsl (str): the query DSL field to run on all documents prior
                to aggregating the results. Either a query string or a query
                DSL has to be present.
            supported_charts: Chart type to render. Defaults to table.
            start_time: Optional ISO formatted date string that limits the time
                range for the aggregation.
            end_time: Optional ISO formatted date string that limits the time
                range for the aggregation.
            limit (int): How many buckets to return, defaults to 10.

        Returns:
            Instance of interface.AggregationResult with aggregation result.

        Raises:
            ValueError: if neither query_string or query_dsl is provided.
        """
        if not (query_string or query_dsl):
            raise ValueError('Both query_string and query_dsl are missing')

        self.field = field
        formatted_field_name = self.format_field_by_type(field)

        aggregation_spec = get_spec(
            field=formatted_field_name, limit=limit, query=query_string,
            query_dsl=query_dsl)

        aggregation_spec = self._add_query_to_aggregation_spec(
            aggregation_spec, start_time=start_time, end_time=end_time)

        # Encoding information for Vega-Lite.
        encoding = {
            'x': {
                'field': field,
                'type': 'nominal',
                'sort': {
                    'op': 'sum',
                    'field': 'count',
                    'order': 'descending'
                }
            },
            'y': {'field': 'count', 'type': 'quantitative'},
            'tooltip': [
                {'field': field, 'type': 'nominal'},
                {'field': 'count', 'type': 'quantitative'}],
        }

        response = self.opensearch_aggregation(aggregation_spec)
        aggregations = response.get('aggregations', {})
        aggregation = aggregations.get('aggregation', {})

        buckets = aggregation.get('buckets', [])
        values = []
        for bucket in buckets:
            d = {
                field: bucket.get('key', 'N/A'),
                'count': bucket.get('doc_count', 0)
            }
            values.append(d)

        if query_string:
            extra_query_url = 'AND {0:s}'.format(query_string)
        else:
            extra_query_url = ''

        return interface.AggregationResult(
            encoding=encoding, values=values, chart_type=supported_charts,
            sketch_url=self._sketch_url, field=field,
            extra_query_url=extra_query_url)
def run ( self , field , query_string = '' , query_dsl = '' , supported_charts = 'table' , start_time = '' , end_time = '' , limit = 10 ) : if not ( query_string or query_dsl ) : raise ValueError ( 'Both query_string and query_dsl are missing' ) self . field = field formatted_field_name = self . format_field_by_type ( field ) aggregation_spec = get_spec ( field = formatted_field_name , limit = limit , query = query_string , query_dsl = query_dsl ) aggregation_spec = self . _add_query_to_aggregation_spec ( aggregation_spec , start_time = start_time , end_time = end_time ) # Encoding information for Vega-Lite. encoding = { 'x' : { 'field' : field , 'type' : 'nominal' , 'sort' : { 'op' : 'sum' , 'field' : 'count' , 'order' : 'descending' } } , 'y' : { 'field' : 'count' , 'type' : 'quantitative' } , 'tooltip' : [ { 'field' : field , 'type' : 'nominal' } , { 'field' : 'count' , 'type' : 'quantitative' } ] , } response = self . opensearch_aggregation ( aggregation_spec ) aggregations = response . get ( 'aggregations' , { } ) aggregation = aggregations . get ( 'aggregation' , { } ) buckets = aggregation . get ( 'buckets' , [ ] ) values = [ ] for bucket in buckets : d = { field : bucket . get ( 'key' , 'N/A' ) , 'count' : bucket . get ( 'doc_count' , 0 ) } values . append ( d ) if query_string : extra_query_url = 'AND {0:s}' . format ( query_string ) else : extra_query_url = '' return interface . AggregationResult ( encoding = encoding , values = values , chart_type = supported_charts , sketch_url = self . _sketch_url , field = field , extra_query_url = extra_query_url )