I have following query.
POST test/_search?size=0
{
"size": 0,
"aggs": {
"group_by_RequestID": {
"terms": {
"field": "RequestID"
},
"aggs": {
"total_hits": {
"top_hits": {
"_source": {
"include": [
"_none"
]
}
}
}
}
}
}
}
Response:-
"aggregations": {
"group_by_RequestID": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "20160209 132857.249_5420_1_DEN1100",
"doc_count": 2,
"total_hits": {
"hits": {
"total": 2,
"max_score": 1,
"hits": [
{
"_index": "test",
"_type": "logs",
"_id": "20160209 132857.249_5420_1_DEN1100_Request",
"_score": 1,
"_source": {}
},
{
"_index": "test",
"_type": "logs",
"_id": "20160209 132857.249_5420_1_DEN1100_Response",
"_score": 1,
"_source": {}
}
]
}
}
},
{
"key": "20160209 132857.249_5420_1_SFO",
"doc_count": 1,
"total_hits": {
"hits": {
"total": 1,
"max_score": 1,
"hits": [
{
"_index": "test",
"_type": "logs",
"_id": "20160209 132857.249_5420_1_SFO_Request",
"_score": 1,
"_source": {}
}
]
}
}
For each key I have Request and Response. my result should be the key where I don't have Response, so output should be "20160209 132857.249_5420_1_SFO"
Also How can i get the number of key is missing Response.
Thanks