Count number of times a field has a particular value

[Corey_F]

Hi there,

I have a query like this:

"query": { 
    "multi_match" : {
            "fields" : ["form.*"],
            "lenient": true,
            "query" : "Ineligible"
        }
  }  

This is essentially what I want, in that it finds all the records with "Ineligible" regardless of field, however I'm trying to figure out a way to get just the name of the fields, ideally with a count. Is this possible with ElasticSearch?

To reiterate, within the index, any of the text fields could possibly start with the word "Ineligible", is there a way to query ElasticSearch and have it return a count for the number of times each field has a value that starts with Ineligible?

I'm assuming this would involve an aggregation but I'm having trouble finding the appropriate one.

An example of what would be an ideal outcome would look like:

[
    {
       "key": "form.fieldA",
       "doc_count": 15
    },
    {
       "key": "form.fieldB",
       "doc_count": 9
    }
]

Thanks!

[Mark_Harwood]

@Corey_F

I'm assuming this would involve an aggregation but I'm having trouble finding the appropriate one.

Hi Corey.
My guess is it would be the filters aggregation - you'd use one filter per field so you can segregate the counts. Each filter would have a span_first query to check the word ineligible was the first in that particular text field.

[Corey_F]

Hey Mark, thanks for the reply.

My only issue is this part:

@Mark_Harwood

you'd use one filter per field

Is there a way to do it with wildcards? In my use case there are many fields to consider, and I'd like to consider multiple indexes so it doesn't seem reasonable to update and maintain the query for every field addition.

[Mark_Harwood]

I don’t think scripted aggs/queries offer the APIs to do the sort of efficient word position checking you need here.
Your requirement is a slightly unusual one so sadly not something we offer a succinct way of doing.