ElasticSearch - Filter Buckets

Elastic Stack Elasticsearch
1

Hey ES community,

My elasticSearch query is like:

{
    "size": 0,
    "aggs": {
        "group_by_id": {
            "terms": {
                "field": "Infos.InstanceInfo.ID.keyword",
                "size": 1000
            },
            "aggs": {
                "tops": {
                    "top_hits": {
                        "size": 100,
                        "sort": {
                            "Infos.InstanceInfo.StartTime": "asc"
                        }
                    }
                }
            }
        }
    }
}

It works fine, I have a result of this form:

aggregations
=========>group_by_id
==============>buckets
                {key:id1}
                ===============>docs
                {doc1.Status:"KO"}
                {doc2.Status:"KO"}
                
                {key:id2}
                ===============>docs
                {doc1.Status:"KO"}
                {doc2.Status:"OK"}
                
                {key:id3}
                ===============>docs
                {doc1.Status:"KO"}
                {doc2.Status:"OK"}

I'm trying to add a filter, so when "KO" the result must be only ids having all docs "KO", id1 for our exemple:

aggregations
=========>group_by_id
==============>buckets
                {key:id1}
                ===============>docs
                {doc1.Status:"KO"}
                {doc2.Status:"KO"}

And a second query with an "OK" filter, to display all the ids having at least one doc with "OK", ids 2 & 3 for our example, the result should be like this:

aggregations
=========>group_by_id
==============>buckets
                {key:id2}
                ===============>docs
                {doc1.Status:"KO"}
                {doc2.Status:"OK"}
                
                {key:id3}
                ===============>docs
                {doc1.Status:"KO"}
                {doc2.Status:"OK"}

Fields " Startime " & " Status " are at the same level " Infos.InstanceInfo. [...]" .

Any idea?

Thanks you in advance

2

Can the expected result be achieved by a request?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.