ELASTICSEARCH - Cumulative_cardinality without histogram

Elastic Stack Elasticsearch
1

With this query I want to make a count of how many unique mobile phone numbers per company.

I have this query that returns the following error:

{"size": 1,
  "_source": "created_at", 
  "aggs": {
    "nested": {
      "nested": {
        "path": "data.addresses"
      },
      "aggs": {
        "phonefield": {
          "terms": {
            "field": "data.addresses.phone.keyword",
            "size": 100
          },
          "aggs": {
            "nested": {
              "nested": {
                "path": "data.addresses.services"
              },
              "aggs": {
                "mobilephone": {
                  "filter": {
                    "term": {
                       "data.addresses.services.mobilephone": "true"
                    }
                  },
                  "aggs": {
                    "company": {
                      "cardinality": {
                        "field": "data.addresses.services.company.keyword"
                      }
                     },
                     "total":{
                       "cumulative_cardinality": {
                         "buckets_path": "company"
                         }
                       }
                      }
                    },
                    "range":{
                      "top_hits": {
                        "size": 1,
                        "sort": [
                          {"created_at.keyword": {"order": "desc"}
                            
                          }
                        ]
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

Output

"Validation Failed: 1: cumulative_cardinality aggregation [total] must have a histogram, date_histogram or auto_date_histogram as parent;"

Would it be possible to obtain the total cumulative cardinility aggregation without a previous histogram?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.