Combining nested and none nested fields in aggregate query

Elastic Stack Elasticsearch
1

Hi guys,

Is it possible to combine nested and none nested fields in aggregate query?

Thanks

2

Which aggregation are we talking about and how should fields be combined?

3

Hi,

I use NEST and wite this kind of objects:

[ElasticsearchType]
  public class LogMessage
  {
    [Object(Name = "key")]
    public MessageKey key { get; set; }
    
    [Nested(Name = "doc")]
    public Object Doc { get; set; }  
  }

key has some simple not nested fields: eventtime and id
Doc has a lot of nested fields, arrays.

I want to aggregate, for example:

{
   "aggs":{
      "agg":{
         "aggs":{
            "agg":{
               "nested":{
                  "path":"doc"
               },
               "aggs":{
                  "agg":{
                     "date_histogram":{
                        "field":"doc.time",
                        "interval":"day",
                        "format":"dd-MM-yyyy"
                     },
                     "aggs":{
                        "agg":{
                           "histogram":{
                              "field":"key.Id",
                              "interval":1.0
                           }
                        }
                     }
                  }
               }
            }
         }
      }
   }
}

but as I understand we can't use not nested key.Id after declared nested path 'doc'

Will change type from
[Object(Name = "key")]
to
[Nested(Name = "key")]

fix it?

Thanks

4

Hi guys,

I found a solution: Reverse nested aggreagtion
https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-reverse-nested-aggregation.html

Thanks