Combining aggregations in a query

Elastic Stack Elasticsearch
1

I am new to Elasticsearch queries and I am trying to combine two aggregations into one aggregation field.

Below I have the basic idea I am trying to get to. I realize that statusCategoriesCombo wont work that way, but I think it helps demonstrate what I am after.

"aggs": {
	"first_specialties": {
		"terms": {
			"field": "firstToDesc"
		}
	},
	"second_specialties": {
		"terms": {
			"field": "secondToDesc"
		}
	},
	"statusCategories": {
		"statusCategoriesCombo": { first_specialties + second_specialties}
	}
}

Is it possible to do something like this? If so, how? And if not do you have any suggestions to solve my problem?

I should also note that I am querying multiple indexes at once. first_specialties and second_specialties are in different indexes.

We are using ES 6.3.2

2

Hi James,

I'm not sure what these aggregations would represent. Ordinarily aggregations are used to account for docs that bring certain combinations of things together eg department and product. For that to happen you have to have a doc that has these two fields in order to make a relationship.

If you have 2 different fields in 2 different indices it's hard to guess what logic might associate pairs of these values together?

3

They output something like this:

   "first_specialties": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "FACILITY / SERVICE",
          "doc_count": 4
        }

"second_specialties" would have the exact same thing with a different doc_count

4

Right. But no single doc would have a first_specialities value AND a second_specialities value so the intersection of values in these sets is zero - no results.

5

Right so what I am really asking is how can I combine the count if the keys match into one agg field. Do I need to use a script for that?

6

If these 2 fields existed in a doc, yes, you could use a script to count the number of times values co-occurred.
Because these 2 fields exist in different indices (and therefore different docs) your script would just generate "pairs" that were of the form: first_speciality:foo + second_speciality:null and first_speciality:null + second_speciality:bar

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.