# Elastic Aggregation: How to analyze the aggregation within an analyzed aggregation

**URL:** <https://discuss.elastic.co/t/elastic-aggregation-how-to-analyze-the-aggregation-within-an-analyzed-aggregation/246871>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [August 30, 2020, 10:13am UTC](https://discuss.elastic.co/t/elastic-aggregation-how-to-analyze-the-aggregation-within-an-analyzed-aggregation/246871 "2020-08-30T10:13:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ubeta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ubeta/32/70991_2.png) [@Ubeta](https://discuss.elastic.co/u/Ubeta)\
**Post date:** [August 30, 2020, 10:13am UTC](https://discuss.elastic.co/t/elastic-aggregation-how-to-analyze-the-aggregation-within-an-analyzed-aggregation/246871/1 "2020-08-30T10:13:52Z")

</div>

I am trying to use an analyzer within a analzyer on a field and get it's aggregation if that makes sense.

eg.

```auto
Field1.value: 'A01/00 | A02/01 | B01/00'
Field2.value: 'A01/01 | C02/01 | D01/00'

```

Currently, I have a custom pattern analyzer that indexes the terms by the '|' pattern, separating Field1.value and Field2.value into:

```auto
Field1.value terms: [A01/00, A02/01, B01/00]
Field2.value terms: [A01/01, C02/01, D01/00]

```

If I were to aggregate now, each term would give a value count of 1.

What I want to achieve is to further analyze these results through a another pattern analyzer through the forward slash ('/') pattern, creating:

```auto
Field1.value final terms: [A01, A02, B01]
Field2.value final terms: [A01, C02, D01]

```

This would now result in the A01 term aggregation value returning 2, which is what I want.

I have tried a a painless script into my elastic java API code:

```auto
new Script(ScriptType.INLINE, "painless",
    "def path = doc['field.analyzer'].value; " +
    "if (path != null) {" +
    "int index = path.lastIndexOf('/'); " +
    "if (index > 0) {" +
    "return path.substring(0, index);" +
    "}" +
    "}" +
    "return ''", Collections.emptyMap())

```

which gives me the "final" term I want but only returns the first term before the first bar '|' while I want all the final terms.

ei.

```auto
Field1.value final terms: [A01]
Field2.value final terms: [A01]
= gives a value count of 2 for 'A01' but only returns 'A01'

```

I also tried looping through the values and adding them to an array but then the aggregation counts get messed up and are not accurate, which defeats the whole purpose of using aggregations.

```auto
new Script(ScriptType.INLINE, "painless",
    "List returnList = new ArrayList(); " +
    "for (int i = 0; i < doc['field.analyzer'].length; i++) {" +
    "def path = doc['field.analyzer'][i]; " +
    "if (path != null) { " +
    "int index = path.lastIndexOf('/'); " +
    "if (index > 0) { " +
    "returnList.add(path.substring(0, index)); " +
    "} else { " +
    "returnList.add('');} " +
    "} else { " +
    "returnList.add('');}} " +
    "return returnList ", Collections.emptyMap()));

```

returns:

```auto
Field1.value final terms: [A01, A02, B01] value count of exactly one
Field2.value final terms: [A01, C02, D01] value count of exactly one

```

Is there anyway to do a nested analyzer index or a nested aggregation without changing the structure of the data? Or is it possible to use painless in a way to return the correct aggregated terms and value counts without having to do extra java code operations?

Any help is much appreciated.

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2020, 10:13am UTC](https://discuss.elastic.co/t/elastic-aggregation-how-to-analyze-the-aggregation-within-an-analyzed-aggregation/246871/2 "2020-09-27T10:13:57Z")

</div>

Closed on September 27, 2020, 10:13am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.