Count instances of a field in Elasticsearch index

Elastic Stack Elasticsearch
1

How to count the instances of a particular field, across all documents, in a given Elasticsearch index.
For example, if I've got the following documents in index goober :

{
    '_id':'foo',
    'field1':'a value',
    'field2':'a value'
},
{
    '_id':'bar',
    'field1':'a value',
    'field2':'a value'
},
{
    '_id':'baz',
    'field1':'a value',
    'field3':'a value'
}

I'd like to know something like the following:

{
    'index':'goober',
    'field_counts':
        'field1':3,
        'field2':2,
        'field3':1
}

Is this possible?

2

If you know field names at the time of constructing query, you can use exists query for each field. You can combine for multiple exists queries using multi search or nest inside filters aggregation

{
  "size": 0,
  "aggs": {
    "messages": {
      "filters": {
        "filters": {
          "field1": {
            "exists": {
              "field": "field1"
            }
          },
          "field2": {
            "exists": {
              "field": "field2"
            }
          },
          "field3": {
            "exists": {
              "field": "field3"
            }
          }
        }
      }
    }
  }
}
3

Thanks, it works.

Can you please also advise if it is possible to execute such request for all properties without explicitly specify all the fields?

4

Unless you have turned off dynamic mapping, any document inserted or updated, can add more fields to the existing index mapping. So the listing of "all properties" can change by the time your query reaches server.

If you need it for a daily / weekly report, then you can write a small script to fetch index mapping using curl -XGET http://<host>:<port>/<index>/_mappings and then recursively extract properties to form the list.

What's your use case?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.