Hello,
I am experiencing strange behavior when using aggregations combining children, nested, and filter aggs (with a range filter).
It looks like children aggregation is somehow affecting the range filter - it either returns count of all nested docs of a child document or none.
PUT /nestingtest/
{
"mappings": {
"teams": {
properties: {
name: {
type: "string",
index: "not_analyzed",
doc_values: true
}
}
},
"tasks": {
_parent: { type: "teams" },
properties: {
task_id: {
type: "long",
doc_values: true
},
started_at: {
type: "object",
properties: {
raw: {
type: "date",
doc_values: true
},
year: {
type: "short",
doc_values: true
},
month: {
type: "short",
doc_values: true
},
day: {
type: "short",
doc_values: true
},
hour: {
type: "short",
doc_values: true
},
minute: {
type: "short",
doc_values: true
},
wday: {
type: "short",
doc_values: true
}
}
},
events: {
type: "nested",
properties: {
id: {
type: "long",
doc_values: true
},
happened_at: {
type: "object",
properties: {
raw: {
type: "date",
doc_values: true
},
year: {
type: "short",
doc_values: true
},
month: {
type: "short",
doc_values: true
},
day: {
type: "short",
doc_values: true
},
hour: {
type: "short",
doc_values: true
},
minute: {
type: "short",
doc_values: true
},
wday: {
type: "short",
doc_values: true
}
}
}
}
}
}
}
}
}
Data:
POST /nestingtest/teams/1
{ name: "team-A"}
POST /nestingtest/tasks/1?parent=1
{
_parent: 1,
task_id: 1,
started_at: {
raw: "2015-05-27T13:05",
year: 2015,
month: 5,
day: 27,
hour: 13,
minute: 5,
dow: 3
},
events: [
{
id: 1,
happened_at: {
raw: "2015-05-27T13:10",
year: 2015,
month: 5,
day: 27,
hour: 13,
minute: 10,
dow: 3
}
}
]
}
POST /nestingtest/tasks/2?parent=1
{
_parent: 1,
task_id: 2,
started_at: {
raw: "2015-05-27T16:05",
year: 2015,
month: 5,
day: 27,
hour: 16,
minute: 5,
dow: 3
},
events: [
{
id: 21,
happened_at: {
raw: "2015-05-27T16:10",
year: 2015,
month: 5,
day: 27,
hour: 16,
minute: 10,
dow: 3
}
},
{
id: 22,
happened_at: {
raw: "2015-05-27T17:10",
year: 2015,
month: 5,
day: 27,
hour: 17,
minute: 10,
dow: 3
}
}
]
}
Queries:
This one, querying for parent documents is the one which behaves strangely:
POST /nestingtest/teams/_search?pretty
{
aggs: {
"to-tasks": {
children: {
type: "tasks"
},
aggs: {
"to-events": {
nested: {
path: "tasks.events"
},
aggs: {
filtered: {
filter: {
range: {
"events.happened_at.hour": {
gt: 15
}
}
}
}
}
}
}
}
}
}
This one queries directly children type (i.e., not using children aggregation) and is working as expected. However, I would prefer to query for parent type, as I want to combine other criteria into query.
POST /nestingtest/tasks/_search?pretty
{
aggs: {
"to-events": {
nested: {
path: "events"
},
aggs: {
filtered: {
filter: {
range: {
"events.happened_at.hour": {
gt: 15
}
}
}
}
}
}
}
}