# Aggregation by the first character of field

**URL:** <https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307>\
**Category:** Elasticsearch\
**Created:** [July 8, 2020, 9:05am UTC](https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307 "2020-07-08T09:05:40Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [July 8, 2020, 9:05am UTC](https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307/1 "2020-07-08T09:05:40Z")

</div>

Dears,

Is there any way to do doc aggregation on the first character instead of whole field?

My query in case of whole field:

```auto
GET /log-2020.07.07/_search?size=0
{
  "aggs": {
    "TEXT1": {
      "terms": {
        "field": "ci.rc.keyword",
        "size": 10
      }
    }
  }
}

```

and result looks like:

```auto
"aggregations" : {
    "TEXT1" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "4001",
          "doc_count" : 14
        },
        {
          "key" : "9113",
          "doc_count" : 12
        },
        {
          "key" : "9777",
          "doc_count" : 6
        },
        {
          "key" : "1010",
          "doc_count" : 4
        },
        {
          "key" : "1608",
          "doc_count" : 4
        },
        {
          "key" : "0001",
          "doc_count" : 2
        },
        {
          "key" : "1000",
          "doc_count" : 2
        }
      ]
    }
  }
}

```

Best Regards,  
Dan

---

<div class="post-metadata">

**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\
**Post date:** [July 8, 2020, 9:32am UTC](https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307/2 "2020-07-08T09:32:35Z")

</div>

There is an option for running a script to get the value. You'd use a script like `doc['ci.rc.keyword'].value.charAt(0)`.

That might not work properly if the character doesn't fit in basic multilingual plane, but it probably does and the script would be a bit more complex than I can compose in an email if it had to deal with that.

---

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [July 8, 2020, 9:49am UTC](https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307/3 "2020-07-08T09:49:55Z")

</div>

> [@nik9000](#):
>
> doc['ci.rc.keyword'].value.charAt(0)

doesn't work:

```auto
"script" : "doc['ci.rc'].value.charAt(0)",
          "lang" : "painless",
          "caused_by" : {
            "type" : "illegal_argument_exception",
            "reason" : "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [hi.rc] in order to load field data by uninverting the inverted index. Note that this can use significant memory."

```

```auto
          "script" : "doc['ci.rc.keyword'].value.charAt(0)",
          "lang" : "painless",
          "caused_by" : {
            "type" : "illegal_state_exception",
            "reason" : "A document doesn't have a value for a field! Use doc[<field>].size()==0 to check if a document is missing a field!"

```

---

<div class="post-metadata">

**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\
**Post date:** [July 8, 2020, 10:05am UTC](https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307/4 "2020-07-08T10:05:49Z")

</div>

I think you'll have to play with the script some. Checking the size first sounds right.

---

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [July 8, 2020, 10:22am UTC](https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307/5 "2020-07-08T10:22:39Z")

</div>

Thanks @nik9000. I'll check it.

---

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [July 9, 2020, 11:48am UTC](https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307/6 "2020-07-09T11:48:49Z")

</div>

@nik9000 script works well in aggregation. Many thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2020, 11:48am UTC](https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307/7 "2020-08-06T11:48:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.