Cross-aggregartion calculation

Elastic Stack Elasticsearch
1

hi
I have 4 aggregations - each runs on a different field.

  "aggs": {
    "URL_1": {
      "terms": {
        "field": "URL_1",
        "size": 1000
      },"aggs": {
        "src_count": {
          "cardinality": {
            "field": "src"
          }
        }
      }
    },
    "URL_2": {
      "terms": {
        "field": "URL_2",
        "size": 1000
      },"aggs": {
        "src_count": {
          "cardinality": {
            "field": "src"
          }
        }
      }
    },
    "URL_3": {
      "terms": {
        "field": "URL_3",
        "size": 1000
      },"aggs": {
        "src_count": {
          "cardinality": {
            "field": "src"
          }
        }
      }
    },
    "URL_4": {
      "terms": {
        "field": "URL_4",
        "size": 1000
      },"aggs": {
        "src_count": {
          "cardinality": {
            "field": "src"
          }
        }
      }
    }
}
}

sometimes I get the same urls in the different aggs
that means that the same key can be found in both URL_1 and URL_2 (or more) with different values in the src_count.

i need to create a "Master" aggregations that calculates the sum of src_count for each key on all 4 aggregations .

is there a way of doing that ?

using ES 5.5
Tnx

2

Either reindex and look at the copy_to [1] mapping to put urls 1 to 4 in a new combined "urls" field or use a single terms agg and use a script [2] to fuse urls 1 to 4 into a new array on the fly

[1] copy_to | Elasticsearch Guide [8.11] | Elastic
[2] Terms aggregation | Elasticsearch Guide [8.11] | Elastic

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.