Aggregating inner_hits data

Elastic Stack Elasticsearch
1

Hi,

I am naive to Elastic Search. I found there is some problem with array of objects:
https://www.elastic.co/guide/en/elasticsearch/guide/current/complex-core-fields.html#object-arrays

The solution for this problem given is nested query:
https://www.elastic.co/guide/en/elasticsearch/reference/2.2/nested.html

I was trying to use this for my use case. Data fomat of my use case:
"wifi": [
{
"point": 1,
"cha": 14,
"chb": 2
},
{
"point": 2,
"cha": 7,
"chb": 6
}
]
There are many entries like this.
I used nested query to filter only wifi.point value 1:
GET my_index4/_search
{
"_source" : false,
"query": {
"nested": {
"path": "wifi",
"query": {
"bool": {
"must": [
{ "match": { "wifi.point": 1 }}
]
}
},
"inner_hits": {
"highlight": {
}
}
}
}
}

It displays data inside the inner_hits for wifi.point 1.
I need to aggregate this inner_hits data. How can I do this?

Thanks.

2

See nested aggregations: Nested Aggregation | Elasticsearch Guide [5.1] | Elastic

3

Hi Mark,

Thanks for the information.
I did the aggregation on nested data using this:
GET my_index4/_search
{
"_source": false,
"size": 0,
"aggs": {
"wifi": {
"nested": {
"path": "wifi"
},
"aggs": {
"only_point_name": {
"filter": {
"terms": {
"wifi.point": [
1,2
]
}
},
"aggs": {
"my_agg_1": {
"terms": {
"field": "wifi.point"
},
"aggs": {
"my_agg_2": {
"sum": {
"field": "wifi.chb"
}
}
}
}
}
}
}
}
}
}
It worked fine. Now I need to allow aggregation on data other than the wifi object like "time" and "Id.Mac".
Data format:
{
"time" : 1477373600000,
"Id" : {
"Type" : "NODE",
"Mac" : "00:06:65:2b:d2:40"
},
"wifi" : [{
"point" : 1,
"cha" : 14,
"chb" : 2
}, {
"point" : 2,
"cha" : 7,
"chb" : 6
}
]
}
I tried putting these instead of wifi.point in my above GET query but it didn't generate any output.
How can i do this?

Thanks.

4

Nested aggregations are only to be used on sections of your document that are defined as "nested" in your mapping definition for the index/doctype. The mapping controls if sub-objects in your JSON docs are mapped to "nested" documents in the index or not.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.