Aggregation: unique count grouped by combination of field value

Elastic Stack Kibana
1

Given following documents (simplified) in an index:

{
  "vehicle": "A",
  "source": "foo"
}
{
  "vehicle": "A",
  "source": "bar"
}
{
  "vehicle": "A",
  "source": "foo"
}
{
  "vehicle": "B",
  "source": "foo"
}
{
  "vehicle": "B",
  "source": "foo"
}
{
  "vehicle": "C",
  "source": "bar"
}

How can I create aggregation to retrieve unique count of vehicles grouped by source combinations with following result:

Source         Unique vehicle count
====================================
foo            1 (this is vehicle B)
bar            1 (this is vehicle C)
foo, bar       1 (this is vehicle A)
2

Any input on this would be highly appreciated.

If it is not possible to achieve such query with current document fields we could adjust the document content to make it easier.

3

With the way the data is currently indexed, I don't think you can accomplish exactly what you'd like; the closest you could get is something like this:

Source         Unique vehicle count
====================================
foo            2 (this is vehicle A/B)
bar            1 (this is vehicle C)

You'd have to use a separate index where you actually index the vehicle with the different source combinations.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.