Can i aggregate a nested field content?


(sharon) #1

Hi all!
Im trying to do and aggregation of the values in a nested query, on an earlier query.

I managed to do the following:

POST /flow_test/sometest

POST flow_test/_mapping/sometest
{
"properties": {
"cerdentials": {
"type": "nested",
"properties": {
"name": {
"type": "string"
}
}
},
"cookies": {
"type": "nested",
"properties": {
"name": {
"type": "string"
}
}
},
"files": {
"type": "nested",
"properties": {
"name": {
"type": "string"
}
}
},
"flow_id": {
"type": "string"
}
}
}

now insert 2 docs ( or more )

POST /flow_test/sometest
{
"flow_id":"something else",
"cookies":[{"name":"ck1"},{"name":"ck2"},{"name":"ck3"}],
"cerdentials":[{"name":"c1"},{"name":"c2"},{"name":"c3"}],
"files":[{"name":"f1"}, {"name":"f2"}, {"name":"f3"}]
}

now i want to first make a query to find all the documents that one of its nested field contains my variable ( we will try on cookies on this example)
I manged to do it easily, but now i want to aggregate on these results, so i will see the following :

files:
f1-2,
f2-1
cerdentials:
c1-3,
c3-1

this will represent how many documents has f1 on their nested files field in the result ( which already filtered the cookie).

The closest i got was counting the size of the nested field:

I did it like so :

GET /flow_test/sometest/_search?pretty
{
"query":{
"bool": {
"must": [
{"match_all": {}},
{
"nested":{
"path":"cookies",
"query":{
"bool":{
"must":[
{
"match":{
"cookies.name":"ck2"
}
}
]
}
}
}
}
]
}
},
"aggregations":{
"someAggregation":{
"nested":{
"path": "cerdentials"
},
"aggs":{
"cerdentialsCount":{
"cardinality":{
"field": "cerdentials.name"
}
}
}
}
}
}

I cant think of a way to preform this. my nested object might contain a complex object and not just name like in the example, so how will i compare the 2 to aggregate them ? is it even possible?

Im also very open to changing my document design, if necessary.

Thanks in advance!


(sharon) #2

Actually the question can be narrowed down to:
Can i aggregate the content of a nested field?
if i have 2 documents with nested field:
nested: [{name: some name},{name:other name}]
nested2:[{name:some name},{name:bla bla}]
the result i want is :slight_smile:
some name - 2
other name - 1
bla bla - 1

Is it possible ? or for that particular scenario Elasticsearch is not the solution?


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.