Actually, after a chat on IRC, I found a solution that is doing almost what I want. By running this query
{
"size": 0,
"query": {
"bool": {
"filter": {
"terms": {
"target_ids": [
"000",
"111",
"222"
]
}
}
}
},
"aggs": {
"bucket": {
"terms": {
"field": "ref_id",
"size": 10
},
"aggs": {
"metric": {
"terms": {
"field": "target_ids",
"include": ["000", "111", "222"],
"size": 3
}
}
}
}
}
}
I am only interested in the actual size of the target_ids terms aggregation. I understand that doing this from a custom application point of view is super easy (just count the key in the bucket) but I am trying . to plug this into Kibana to get back a sort of Cardinality count but only on the restricted value I passed in the filter and include.
Is there any way to get back from Elasticsearch the size of the target_ids terms aggregation instead the terms aggregation results?
I actually created a new metric in Kibana to run the restricted unique count on the passed filter but it seems that Kibana is able to handle metrics that return a single value per bucket instead of another aggregation. Another solution would be to have Kibana be able to handle responses that are not just a value but a more complex JSON.
But this is getting out of the main scope of my question.