Aggregation

Elastic Stack Elasticsearch
1

Hi,
I'm trying to understand how to create an aggregation query for tag distribution.

Record example:

{
 @timestamp: {iso time} ,
 record_type: {string},
 record_data: {string},
 tags: [ {key: {string}, value: {string}}, ...]
}

I want to query the data and get a distribution of tags (key, value) over a specific record type.
Example of response:

{
"record_type_1":
   [
       {key: "key1",
        value: "value1",
        count: 2
       },
       {key: "key2",
        value: "value2",
        count: 1
       }
   ]
}

I'm not sure which aggregation pipeline should I use?

2

if tags field is mapped as nested type, then you need to check the bellow link

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.