Elasticsearch query to filter count by aggregate

Elastic Stack Elasticsearch
1

I am writing a query to count documents, group by modifiedDateTime. This query works fine as below

{
    "aggs" : {
        "types_count" : { 
          "value_count" : { "field" : "id" }
        },
        "group_by_status": {
          "terms": {
            "field": "status.keyword"
          }
        }
    }
}

This query gives me the proper buckets as below

"buckets": [
        {
          "key": "STARTED",
          "doc_count": 579873
        },
        {
          "key": "SENT",
          "doc_count": 363026
        },

Now our process is such that once its triggered its state is STARTED, next its SEND, then its AWATING_RESPONSE, then it goes to COMPLETED and each time process moves to next state its version is incremented.

So essentially with above query i am counting all the process which are in different state, but the trick here is a process which is STARTED is also counted in SENT since its the same process with different version.

Now how i want to create a query is to provide me the count for all the different stated but it should consider only the latest version not all versions.

I tried something like below

{
    "aggs" : {
        "types_count" : { 
          "value_count" : { "field" : "id" }
        },
        "aggs" : {
          "max_version" : { "max" : { "field" : "version" } }
        },
        "group_by_status": {
          "terms": {
            "field": "status.keyword"
          }
        }
    }
}

but it gives me this error

"root_cause": [
      {
        "type": "named_object_not_found_exception",
        "reason": "[7:27] unable to parse BaseAggregationBuilder with name [max_version]: parser not found"
      }
    ]

Any way this can be achieved ?

1 Like
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.