Elasticsearch aggregation with regexp


(Ciprian Pascu) #1

Hi,
I have the following query:

curl http://localhost:9200/<my_index>/_search

with this body:

{
"aggs" : {
"host" : {
"terms": {
"field": "host",
"include" : ".*"
}
}
}
}

Mapping for the 'host' field is like this:

      "host" : {
        "index" : "not_analyzed",
        "type" : "string"
      }

The problem is, when issuing the query, I always get something that starts like this:

"aggregations": {
"host": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 368

My question is: why there are some unmatched documents? As I've shown above, the regexp was: "include" : ".*", meaning all. Am I missing anything?

Thank you!

Ciprian.


(Mark Harwood) #2

Don't supply an include clause - that would implicitly mean "all" and using a regex will only add performance overhead.


(Ciprian Pascu) #3

Ok, thanks for the hint :)!


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.