ElasticSearch Aggregation Problem


(Sumit Gupta) #1

HI All,

I have Document like that where CallTy and LegTy have values 0,1,2
{
_index: klocal_2014_03_20
_type: CDR
_id: zURwiQMYT02kBVH93lOzhg
_version: 1
_score: 1
_source: {
type: CDR
RecTy: 61
FROM: 15867094430
TO: 19316267860
RecID: 660101
CallTy: 0
CallRef: 3119340
LegTy: 1
SeTime: 140131234920+0500
AnsTim: 140131234920+0500
ReTime: 140131234941+0500
CallDur: 21
TermRC: 0
Diag: 16
GID:
PayTy: 0
LOC: 310410
MeIP: 199.47.227.30
MPort: 38884
SubTy: 2
IMEI: 352702052011777
PSTy: 0
RemEn: 1
@timestamp: 2014-03-20T10:02:44+05:30
_ttl: 2d
}
}

When i write Aggregation query for LegTy and SubTy it gives result like
curl -XPOST "http://localhost:9200/klocal_2014_03_19/CDR/_search?pretty" -d'
{
"size": 0,
"aggregations": {
"LegTy": {
"terms": {
"field": "LegTy"
}
},
"SubTy": {
"terms": {
"field": "SubTy"
}
}
}
}'

Output:

{
"took" : 13,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 241,
"max_score" : 0.0,
"hits" : [ ]
},
"aggregations" : {
"LegTy" : {
"buckets" : [ {
"key" : 0,
"doc_count" : 120
}, {
"key" : 1,
"doc_count" : 119
}, {
"key" : 2,
"doc_count" : 2
} ]
},
"SubTy" : {
"buckets" : [ {
"key" : 2,
"doc_count" : 225
}, {
"key" : 1,
"doc_count" : 16
} ]
}
}
}

But I want output Like

"key" : [0,2],
"doc_count" : XXX,
"key" : [0,1],
"doc_count" : XXX,
"key" : [1,2],
"doc_count" : XXX,
"key" : [1,1],
"doc_count" : XXX,
"key" : [2,2],
"doc_count" : XXX,
"key" : [2,1],
"doc_count" : XXX

Please Suggest.

Thanks & Regards,
Sumit Gupta


(Sumit Gupta) #2

Solve it using Aggregating Hierarchical Data.

Regards,
Sumit Gupta


(system) #3