Aggregating tags


we are using a index where we have 3 fields type, fileinfo and timestamp.

In the fileinfo field I will be having a json String where there will count of different number of file formats.


Now my problem is I want to set the sum of the size of all the pdf files. similary for other types of files

Is there any way to do this.


Take a look at scripted metric aggregations. You could do a terms aggregation on type, and in your script sum the size field.