Agregation on cURL

Elastic Stack Elasticsearch
1

I have a field named "remetente" containing e-mails, i want do agroup then by de top 10 higher hits between them, this is the cURL:

curl -XGET "http://localhost:9200/_search" -H 'Content-Type: application/json' -d'
{
"size": 0,
"aggs": {
	"group_by_state": {
		"terms": {
		"field": "remetente"
		}
	}
  }
}'

but running this comand, return e following error:

`{"took":1019,"timed_out":false,"_shards": 
{"total":17,"successful":12,"skipped":0,"failed":5,"failures": 
[{"shard":0,"index":"imsva_message","node":"NYJSJOgHTXCdT8OW73dAxQ","reason" : 
{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by 
default. Set fielddata=true on [remetente] in order to load fielddata in memory by 
uninverting the inverted index. Note that this can however use significant memory. 
Alternatively use a keyword field instead."}}]},"hits":{"total":11585745,"max_score":0.0,"hits": 
[]},"aggregations":{"group_by_state": 
{"doc_count_error_upper_bound":0,"sum_other_doc_count":0,"buckets":[]}}}
2

The problem here is that you are trying to do Terms Aggregation over an analyzed field, which is not supported by default.

There are two possible workarounds here:

  1. Aggregate over a keyword field instead of text. If you have used standard dynamic mapping then you probably have the remetente.keyword field. Try aggregating over this field. If this does not exists, then you need to create a field of type keyword and use that field for aggregation.
  2. If you really need to aggregate over an analyzed field (i.e. of type text) then you can still do it by setting fielddata: true in this remetente field mapping. But keep in mind that this can potentially use lots of heap memory which will lead to GC pressure and cause performance issues.

You can learn more about fielddata here: https://www.elastic.co/guide/en/elasticsearch/reference/current/fielddata.html

3

Thank you thiago, now it's working.
Brigadão mano vi que você e de SP kk.

4

I am glad your problem is solved!

Sou do RJ :slight_smile:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.