Conditional path in nested aggregation

Hi, I have a nested field with two properties:

    "rating": 2
    "victim": [{
        "ip":  "...",
        "instanceId": "....""

I want to aggregate over the rating and get the IP or InstanceId for each document, not both in the bucket list.


After a lot of searching i found the way via painless:

"terms" : {
    "script" : {
        "source": "doc['victim.instanceId'].value == null ? doc['victim.ip'] : doc['victim.instanceId']",
        "lang": "painless"
    "missing": "N/A"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.