Field type keyword aggregation returns zero results

I have an index with below mapping

{
"image-removal-rcpt-index-2018-07-02-1": {
"mappings": {
"imageremovalrcpt": {
"properties": {
"blacklist_id": {
"type": "long"
},
"customer_id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"day": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"child_guid": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"message_id": {
"type": "text",
"fields": {
"raw": {
"type": "keyword"
}
}
},
"from_field": {
"type": "text",
"fields": {
"email": {
"type": "text",
"analyzer": "email_analyzer"
},
"ngram": {
"type": "text",
"analyzer": "nGram_analyzer",
"search_analyzer": "standard"
},
"raw": {
"type": "keyword"
}
}
},
"hour": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"is_blacklisted": {
"type": "boolean"
},
"minute": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"month": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"rcpt_message_id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"rcpt_to_field": {
"type": "text",
"fields": {
"email": {
"type": "text",
"analyzer": "email_analyzer"
},
"ngram": {
"type": "text",
"analyzer": "nGram_analyzer",
"search_analyzer": "standard"
},
"raw": {
"type": "keyword"
}
}
},
"rcpt_to_item": {
"type": "text",
"fields": {
"email": {
"type": "text",
"analyzer": "email_analyzer"
},
"ngram": {
"type": "text",
"analyzer": "nGram_analyzer",
"search_analyzer": "standard"
},
"raw": {
"type": "keyword"
}
}
},
"second": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"subject_field": {
"type": "text",
"fields": {
"ngram": {
"type": "text",
"analyzer": "nGram_analyzer",
"search_analyzer": "standard"
},
"raw": {
"type": "keyword"
}
}
},
"timestamp": {
"type": "date"
},
"year": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
}
}

I use a query to get the total number of unique items based upon below query:

$query = array(
'index' => 'image-removal-rcpt-index-2018-07-02-1',
'type' => 'imageremovalrcpt',
'body' => array(
'query' => array(
'bool' => array(
'should' => array(
array('match' => array('is_blacklisted' => false))
),
'minimum_should_match' => 1,
'filter' => array(
'range' => array(
'timestamp' => array(
'gte' => sometime,
'lte' => othertime,
),
),
),
),
),
'aggs' => array(
'message_id' => array(
'terms' => array(
'field' => 'message_id.raw',
),
),
)
)
);

But the aggregation buckets return empty. As I understand that in order to have the aggregation on text field, we can add one more field using of datatype keyword, so in my mapping, I have added
"message_id": {
"type": "text",
"fields": {
"raw": {
"type": "keyword"
}
}

But it does not return any buckets > 0.

What is that I may be doin wrong?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.