Combining nested and non nested aggregations

Elastic Stack Elasticsearch
1

Not sure if this is the right place to post but here goes...

How do I create a bucket aggregation (in this case terms aggregations), that keys off of a nested field AND a non nested field. I would like to the results to be a single bucketaggregation (with other sub aggregations included).

Example mapping:

"mappings": {
  "test": {
    "dynamic": "false",
    "properties": {
      "foo": {
        "dynamic": "false",
        "properties": {
          "bar": {
            "dynamic": "false",
            "properties": {
              "id": {
                "type": "long"
              }
            }
          },
          "nesty": {
            "type": "nested",
            "properties": {
              "bar": {
                "dynamic": "false",
                "properties": {
                  "id": {
                    "type": "long"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

Example documents

{ "foo":
  { "nesty": [
    { "bar":{"id":1}},
    { "bar":{"id":2}}
    ]
  }
}

{ "foo": { "bar" : {"id": 1} } }

What I expect back:

  "aggregations" : {
      "blah" : {  
          "buckets" : [ 
            {
                "key" : "1",
                "doc_count" : 2,
                ...
            },
            {
                "key" : "2",
                "doc_count" : 1,
                ...
            }
          ]
      }
  }

Here's what I have tried so far

GET _search
{
  "size": 0,
  "aggs": {
    "a": {
      "nested": {
        "path": "foo.nesty"
      },
      "aggs": {
        "a": {
          "terms": {
            "script": "if (doc['foo.bar.id'].value != 0) {return doc['foo.bar.id'].value} return doc['foo.nesty.bar.id'].value"
          }
        }
      }
    },
    "b": {
      "terms": {
        "script": {
          "inline": "if (doc['foo.bar.id'].value != 0) {return doc['foo.bar.id'].value} return doc['foo.nesty.bar.id'].value"
        }
      }
    }
  }
}

There doesn't seem to be a sibling pipeline aggregation that lets me combine the buckets from two aggregations either, so if I had two terms aggregations (one nested and one not) I can't seem to combine the buckets they return.

Is there any way to access both a nested field and a non nested field in a script?

2

I think a better strategy would be to enable this at index-time:
https://www.elastic.co/guide/en/elasticsearch/reference/current/copy-to.html

If you copy bar.id and nesty.bar.id to a common field, you can simply bucket on that field.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.