ElasticSeach Query Error in Aggregation

Elastic Stack Elasticsearch
1

Hi Guys,

I am currently trying to do aggregation by my "custom_id" field over the respective "x_count" for each document. There can only be few distinct values in my "custom_id" field.

GET /index1/table1/_search
{
"size": 0,
"query": {
"filtered": {
"query": {
"query_string": {
"query": "*",
"analyze_wildcard": true
}
},
"filter": {
"bool": {
"must": [
{
"range": {
"start_timestamp": {
"gte": 1430483327935,
"lte": 1432988927935
}
}
}
],
"must_not": []
}
}
}
},
"aggs": {
"custom_id": {
"terms": {
"field": "custom_id",
},
"aggs": {
"spe": {
"sum": {
"field": "x_count"
}
}
}
}
}
}

As i am still quiet new to Elasticsearch , i might be missing something obvious .

Thanks.

2

What issue are you getting with the above query? If there is an error in the response can you please paste the error here.

3

Hi

Thanks for the reply!

The error i get was a huge but i think this might be the relevant part.

  • Error:

nested: JsonParseException[Unexpected character ('}' (code 125)): was expecting either valid name character (for unquoted name) or double-quote (for quoted) to start field name\n at [Source: [B@4c8c5b8e; line: 32, column: 2]]; }]",

4

you need to remove the comma at the end of this line in your request to make this valid json.

5

Hi Colin,

Thanks it worked !

Now suppose if i want to aggregate along with range (currently the query is on date range) and also on a specific field type (ex. type_a = 23).

GET /index1/table1/_search
{
"size": 0,
"query": {
"filtered": {
"query": {
"query_string": {
"query": "*",
"analyze_wildcard": true
}
},
"filter": {
"bool": {
"must": [
{
"range": {
"start_timestamp": {
"gte": 1430483327935,
"lte": 1432988927935
}
}
}
],
"must": [
{"term": {
"type_a":23
}
}
],
"must_not": []
}
}
},
"aggs": {
"custom_id": {
"terms": {
"field": "custom_id"
},
"aggs": {
"spe": {
"sum": {
"field": "x_count"
}
}
}
}
}
}

  • Error
    nested: ElasticsearchParseException[Expected field name but got START_OBJECT "aggs"]; }]",
    "status": 400
6

This is again a JSON validation problem. you should use a json validator to fix these issues (e.g. http://jsonlint.com/)

7

Hi Collin,

Thanks for the link and answering my naive questions so quickly :smiley:

it was showing me an error for "}" was missing when i added the "}" at the end, it became a valid JSON but still i am getting the same error:

-Error

nested: ElasticsearchParseException[Expected field name but got START_OBJECT "aggs"]; }]",

8

You need to add the brace before the comma here instead

9

Thanks ! it worked.

10

Hi @colings86

If i want to print more information related to "custom_id" which is unique for all documents which have that particular custom_id. Can i get that by adding some arguments in the same query. I tried

"_include" but its not working.

11

It depends what extra information you wanted to print but the general method would be to add more aggregations alongside your spe aggregation

12

Hi Collin,

I was able to get it but i ended up using something which i think might be weird

Not a complete query:

"SpecificInfo": {
"top_hits": {
"sort": [
{
"start_timestamp": {
"order": "desc"
}
}
],
"_source": {
"include": [
"age_max"
,"age_min"
]
},
"size" : 1
}
}

Another question, i had in mind was suppose i wanted another metric which was a division of my aggregators (in this example "spe" and lets call another aggregator "gain") . I wanted to add another metric which was division of spe/gain, how would i got about it.

I might be able to use "bucket_path" but don't have a concrete path to it.

Thanks again!