Conditional path in nested aggregation

[elpaisa (John Diaz)]

Hi, I have a nested field with two properties:

{
    "rating": 2
    "victim": [{
        "ip":  "...",
        "instanceId": "....""
    }]
}

I want to aggregate over the rating and get the IP or InstanceId for each document, not both in the bucket list.

Thanks.

[elpaisa (John Diaz)]

After a lot of searching i found the way via painless:

"terms" : {
    "script" : {
        "source": "doc['victim.instanceId'].value == null ? doc['victim.ip'] : doc['victim.instanceId']",
        "lang": "painless"
    },
    "missing": "N/A"
}