Aggregation not working on Scripted field


(Shakti Gupta) #1

Hi Folks,

I am trying to perform bucket aggregation on scripted field but getting empty result while search result are coming fine but not aggregation result.

"aggregations": {
    "level": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [

      ]
    }
  } 

My query is

        {
          "size": 10,
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "request_url: *.html*",
                    "analyze_wildcard": true
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "from": "now-24h",
                      "to": "now"
                    }
                  }
                }
              ],
              "must_not": []
            }
          },
          "script_fields": {
            "my_base_url_scripted": {
              "script": "def path = doc['request_url'].value; if (path != null) { int firstQIndex = path.indexOf('.html'); if (firstQIndex > 0) { firstQIndex = firstQIndex + 5; return path.substring(0,firstQIndex); } } return path;"
            }
          },
        "aggs" : {
             "level" : {
                "terms" : {
                  "field" : "my_base_url_scripted",
                  "size" : 300000
                          }
                        }
          },
          "docvalue_fields": [
            "@timestamp"
          ]
        }

Kindly help.


(Adrien Grand) #2

Aggregations do not support reusing script_fields definitions. You need to put the script directly into your aggregation definition:

        "aggs" : {
             "level" : {
                "terms" : {
                  "script" : "def path = doc['request_url'].value; if (path != null) { int firstQIndex = path.indexOf('.html'); if (firstQIndex > 0) { firstQIndex = firstQIndex + 5; return path.substring(0,firstQIndex); } } return path;",
                  "size" : 300000
                          }
                        }
          }

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.