Condition on term

Elastic Stack Elasticsearch
1

Hi guys, sorry to bother, just wanted to know if there is possible to add a condition for a term. So I have something like this:

"should": [ { "term": { "results.value.testRun.name": "Int" } }, { "term": { "results.value.testRun.name": "Test" } }, { "term": { "results.value.testRun.name": "Live" } } ]

And then I have an aggs to show only if min_doc_count : 2.

My question is if there is anyway to add a condition to the last term "results.value.testRun.name": "Live" to allow me to show results even if min_doc_count: 1 (But should be :2 for the other ones)

Did I explain good ?

Thanks.

2

I don't quite understand what the aggregation is for. And how the field content for results.value.testRun.name looks like for some example documents. Is this a multi valued keyword field? Or some sort of text field where you want to match any of the three given terms?
Maybe an example with the mapping for the field, some example documents and a full example query including the agg would help to understand your goal better.

3

Thanks!

So, basically the field content is a string ("Live", "Test"). The aggregation is to show the testcases that belong to that testrun but if they failed more than 2 times.

So,
"aggs": {
"testname": {
"terms": {
"field": "results.value.testCase.name",
"size": 1000,
"min_doc_count": 2
},

What I would like to do is, if the testrun is == Live, then min_doc_count:1.

The idea is to retrieve the tests that failed more than 1 time in test, but if it failed just 1 time on Live, retrieve it anyways.

Is that better ?

Hope this helps:

"filter": {
"bool": {
"should": [
{
"term": {
"results.value.testRun.name": "Test"
}
},
{
"term": {
"results.value.testRun.name": "Live"
}
}
]
}
}
}
},
"aggs": {
"testname": {
"terms": {
"field": "results.value.testCase.name",
"size": 1000,
"min_doc_count": 2
},

4

I'm making some bold guesses abour your use case here but maybe you could use a filter aqggregation to create a bucket with all the docs with a "Live" failure and another top level one with all the results where you would use "min_doc_count" : 2? I think you need to de-duplicate somewhere in your application then unfortunately. This is a short example of what I mean but it might need some adaption to fit your needs:

DELETE my_index

POST my_index/_bulk
{ "index" : { } }
{ "testRun" : "Test", "testCase" : "caseA" }
{ "index" : { } }
{ "testRun" : "Live", "testCase" : "caseA" }
{ "index" : { } }
{ "testRun" : "Test", "testCase" : "caseB" }
{ "index" : { } }
{ "testRun" : "Live", "testCase" : "caseC" }


POST my_index/_search?size=0
{
  "query": {
    "bool": {
      "should": [
        {
          "term": {
            "testRun": "test"
          }
        },
        {
          "term": {
            "testRun": "live"
          }
        }
      ]
    }
  },
  "aggs": {
    "live_only": {
      "filter": {
        "term": {
          "testRun": "live"
        }
      },
      "aggs": {
        "live_once": {
          "terms": {
            "field": "testCase.keyword",
            "size": 1000,
            "min_doc_count": 1
          }
        }
      }
    },
    "all": {
      "terms": {
        "field": "testCase.keyword",
        "size": 1000,
        "min_doc_count": 2
      }
    }
  }
}

Btw. using ``` around your code snippets for easier-to-read formatting is highly appreciated in the forum. Thanks.

1 Like
5

Thanks a lot, I will give that a try. Appreciate your help and sorry for formatting :smiley:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.