ElasticSeach Query Error in Aggregation


(Aditya Patel) #1

Hi Guys,

I am currently trying to do aggregation by my "custom_id" field over the respective "x_count" for each document. There can only be few distinct values in my "custom_id" field.

GET /index1/table1/_search
{
"size": 0,
"query": {
"filtered": {
"query": {
"query_string": {
"query": "*",
"analyze_wildcard": true
}
},
"filter": {
"bool": {
"must": [
{
"range": {
"start_timestamp": {
"gte": 1430483327935,
"lte": 1432988927935
}
}
}
],
"must_not": []
}
}
}
},
"aggs": {
"custom_id": {
"terms": {
"field": "custom_id",
},
"aggs": {
"spe": {
"sum": {
"field": "x_count"
}
}
}
}
}
}

As i am still quiet new to Elasticsearch , i might be missing something obvious .

Thanks.


(Colin Goodheart-Smithe) #2

What issue are you getting with the above query? If there is an error in the response can you please paste the error here.


(Aditya Patel) #3

Hi

Thanks for the reply!

The error i get was a huge but i think this might be the relevant part.

  • Error:

nested: JsonParseException[Unexpected character ('}' (code 125)): was expecting either valid name character (for unquoted name) or double-quote (for quoted) to start field name\n at [Source: [B@4c8c5b8e; line: 32, column: 2]]; }]",


(Colin Goodheart-Smithe) #4

you need to remove the comma at the end of this line in your request to make this valid json.


(Aditya Patel) #5

Hi Colin,

Thanks it worked !

Now suppose if i want to aggregate along with range (currently the query is on date range) and also on a specific field type (ex. type_a = 23).

GET /index1/table1/_search
{
"size": 0,
"query": {
"filtered": {
"query": {
"query_string": {
"query": "*",
"analyze_wildcard": true
}
},
"filter": {
"bool": {
"must": [
{
"range": {
"start_timestamp": {
"gte": 1430483327935,
"lte": 1432988927935
}
}
}
],
"must": [
{"term": {
"type_a":23
}
}
],
"must_not": []
}
}
},
"aggs": {
"custom_id": {
"terms": {
"field": "custom_id"
},
"aggs": {
"spe": {
"sum": {
"field": "x_count"
}
}
}
}
}
}

  • Error
    nested: ElasticsearchParseException[Expected field name but got START_OBJECT "aggs"]; }]",
    "status": 400

(Colin Goodheart-Smithe) #6

This is again a JSON validation problem. you should use a json validator to fix these issues (e.g. http://jsonlint.com/)


(Aditya Patel) #7

Hi Collin,

Thanks for the link and answering my naive questions so quickly :smiley:

it was showing me an error for "}" was missing when i added the "}" at the end, it became a valid JSON but still i am getting the same error:

-Error

nested: ElasticsearchParseException[Expected field name but got START_OBJECT "aggs"]; }]",


(Colin Goodheart-Smithe) #8

You need to add the brace before the comma here instead


(Aditya Patel) #9

Thanks ! it worked.


(Aditya Patel) #10

Hi @colings86

If i want to print more information related to "custom_id" which is unique for all documents which have that particular custom_id. Can i get that by adding some arguments in the same query. I tried

"_include" but its not working.


(Colin Goodheart-Smithe) #11

It depends what extra information you wanted to print but the general method would be to add more aggregations alongside your spe aggregation


(Aditya Patel) #12

Hi Collin,

I was able to get it but i ended up using something which i think might be weird

Not a complete query:

"SpecificInfo": {
"top_hits": {
"sort": [
{
"start_timestamp": {
"order": "desc"
}
}
],
"_source": {
"include": [
"age_max"
,"age_min"
]
},
"size" : 1
}
}

Another question, i had in mind was suppose i wanted another metric which was a division of my aggregators (in this example "spe" and lets call another aggregator "gain") . I wanted to add another metric which was division of spe/gain, how would i got about it.

I might be able to use "bucket_path" but don't have a concrete path to it.

Thanks again!


(system) #13