Aggregation on Searcresult with terms (Buckets inside Buckets)

Elastic Stack Elasticsearch
1

Hello,

i have documents with this json description

...         
            "Attributes": {
                "type": "nested",
                "properties": {
                    "Identifier": {
                        "type": "string",
                        "index": "not_analyzed"
                    },
                    "Value": {
                        "type": "string",
                        "index": "not_analyzed"
                    },
                }
            },
...

where i do my search with the java API. Now i like to make some Aggregation on my search result.
with
AggregationBuilder aggregation = AggregationBuilders.nested("Identifier").path("Attributes");
aggregation.subAggregation(AggregationBuilders.terms("agg_ident").field("Attributes.Identifier"));
i get my Identiefiers.

but i need the count of the Values too.

For example if i have data like this:
attr6 valueA
attr6 valueA
attr6 valueA
attr6 valueB
attr6 valueB
attr7 valueA
attr7 valueA

i need the Result
I have attr6 with valueA 3 Times
I have attr6 with valueB 2 Times
I have attr7 with valueA 2 Times

If i try
AggregationBuilder aggregation = AggregationBuilders.nested("Identifier").path("Attributes");
aggregation.subAggregation(AggregationBuilders.terms("agg_ident").field("Attributes.Identifier"));
aggregation.subAggregation(AggregationBuilders.terms("agg_werte").field("Attributes.Value"));
i get 2 rsults but i lose my relation.

How can i resolve this?

2

I Still try to resolve this problem.

I need a Bucket inside a Bucket as explain here:
https://www.elastic.co/guide/en/elasticsearch/guide/current/_buckets_inside_buckets.html

and this is my request:

{
...
"aggs" : {
    "Identifier" : {
      "nested" : {
        "path" : "Attributes"
      },
      "aggs" : {
        "ident" : {
          "terms" : {"field" : "Attributes.Identifier"}
          },
        "werte" : {
          "terms" : {"field" : "Attributes.Value"}
          }
      }
    }
  }
}

but i get 2 buckets:

  "aggregations":
    {
        "Identifier":
        {
            "doc_count": 411,
            "ident":
            {
                "doc_count_error_upper_bound": 0,
                "sum_other_doc_count": 0,
                "buckets":
                [
                    {
                        "key": "113",
                        "doc_count": 193
                    },
                    {
                        "key": "6",
                        "doc_count": 193
                    },
                    ....
                ]
            },
            "werte":
            {
                "doc_count_error_upper_bound": 0,
                "sum_other_doc_count": 0,
                "buckets":
                [
                    {
                        "key": "24",
                        "doc_count": 147
                    },
                    {
                        "key": "12",
                        "doc_count": 39
                    },
                    ..
                ]
            }
        }
    }

where is my mistake?

3

If you what to know the values of Attributes.Value for each value of Attributes.Identifier, try this instead:

{
    ...
    "aggs" : {
        "Identifier" : {
            "nested" : {
                "path" : "Attributes"
            },
            "aggs" : {
                "ident" : {
                    "terms" : {"field" : "Attributes.Identifier"},
                    "aggs": {
                        "werte" : {
                            "terms" : {"field" : "Attributes.Value"}
                        }
                    }
               }
           }
       }
    }
}
4

Thanks for your answer this works perfect. :grinning:

This was my code:

AggregationBuilder aggregation = AggregationBuilders.nested("Identifier").path("Attributes");
AggregationBuilder aggregation1 = AggregationBuilders.terms("ident").field("Attributes.Identifier");
AggregationBuilder aggregation2 = AggregationBuilders.terms("werte").field("Attributes.Value");

aggregation.subAggregation(aggregation1);
aggregation.subAggregation(aggregation2);

But of course agg2 has to be sub of agg1 and this together has to be sub of agg

aggregation1.subAggregation(aggregation2);
aggregation.subAggregation(aggregation1);

Thanks for the Help!