Aggregate on array objects

Elastic Stack Elasticsearch
1

I want to aggregate document based on entire array object and not single value inside array object.
For example, given are the following documents

{
"took": 15,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 10,
"max_score": 1,
"hits": [
{
"_index": "user_v1",
"_type": "user",
"_id": "1",
"_score": 1,
"_source": {
"userName" : "testuser1",
"field2": ["value1", "value2", "value3"]
}
},
{
"_index": "user_v1",
"_type": "user",
"_id": "2",
"_score": 1,
"_source": {
"userName" : "testuser1",
"field2": ["value1", "value2"]
}
},
{
"_index": "user_v1",
"_type": "user",
"_id": "3",
"_score": 1,
"_source": {
"userName" : "testuser1",
"field2": ["value3"]
}
},
{
"_index": "user_v1",
"_type": "user",
"_id": "4",
"_score": 1,
"_source": {
"userName" : "testuser1",
"field2": ["value1", "value2"]
}
},
]
}
}

I want to aggregate on "field2" and expected response
bucket 1 -> ["value1", "value2", "value3"], count: 1
bucket 2 -> ["value1", "value2"], count: 2
bucket 3 -> ["value3"], count: 1

What is the best way to achieve this using aggregations?

1 Like
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.