I have been trying to use include/exclude patterns on aggregations but I can't understand what the problem is. I want to include only the results that on PLAN_TYPE have the word DATOS. I really don't understand why it gives me results I don't expect. Here are some of the things I have tried:
Request1:
GET _search
{
"size": 0,
"query": {
"query_string": {
"query": "*",
"analyze_wildcard": true
}
},
"aggs": {
"2": {
"terms": {
"field": "PLAN_TYPE",
"include": {
"pattern": ".DA."
},
"size": 105,
"order": {
"1": "desc"
}
},
"aggs": {
"1": {
"sum": {
"field": "SUB_POSTPAGO"
}
}
}
}
}
}
Response1:
GET _search
{
"size": 0,
"query": {
"query_string": {
"query": "*",
"analyze_wildcard": true
}
},
"aggs": {
"2": {
"terms": {
"field": "PLAN_TYPE",
"include": {
"pattern": ".DA."
},
"size": 105,
"order": {
"1": "desc"
}
},
"aggs": {
"1": {
"sum": {
"field": "SUB_POSTPAGO"
}
}
}
}
}
}
If I add a T to make something close to DATOS I get an error:
Request2:
GET _search
{
"size": 0,
"query": {
"query_string": {
"query": "*",
"analyze_wildcard": true
}
},
"aggs": {
"2": {
"terms": {
"field": "PLAN_TYPE",
"include": {
"pattern": ".DAT."
},
"size": 105,
"order": {
"1": "desc"
}
},
"aggs": {
"1": {
"sum": {
"field": "SUB_POSTPAGO"
}
}
}
}
}
}
Response2:
{
"took": 3,
"timed_out": false,
"_shards": {
"total": 11,
"successful": 11,
"failed": 0
},
"hits": {
"total": 3487,
"max_score": 0,
"hits": []
},
"aggregations": {
"2": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": []
}
}
}
Any idea?