Filtering two different nested fields in the same agg

Elastic Stack Elasticsearch
1

I understand how to filter on two nested fields using sub aggregations and get individual doc_counts out of them, but I want to filter and count one nested field by the value of another nested field.

eg:
Imagine a document structure:

{
    some_other_property: "value",
    image: [{
        classification: [{
            label: "xyz",
            probability: 0.00,
        }],
        check: {
            flag: true
        }
    }]
}

I've contrived the field names slightly.

I want to count the total sum of all image nested fields across all documents that have a specific label and probability and where the check flag is a specific value as well.

Is this even possible?

It seems that only a nested agg ({ "aggs": { "nested": ...}}) will properly count the nested image documents. Anything else just counts the parent document, but this, for example:

{
  "size": 0,
  "aggs": {
    "classification": {
      "nested": {
        "path": "image.classification"
      },
      "aggs": {
        "images": {
          "filter": {
            "bool": {
              "filter": [
                {
                  "match_phrase": {
                    "image.classification.label": "other"
                  }
                },
                {
                  "range": {
                    "image.classification.probability": {
                      "gte": "0.9"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "check": {
              "nested": {
                "path": "image.check"
              },
              "aggs": {
                "known": {
                  "filter": {
                    "term": {
                      "image.check.flag": false
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

Returns something like this:

"aggregations" : {
    "classification" : {
      "doc_count" : 3414,
      "images" : {
        "doc_count" : 1107,
        "check" : {
          "doc_count" : 0,
          "known" : {
            "doc_count" : 0
          }
        }
      }
    }
  }

I know for a fact that check and known should certainly be above 0.

Thanks for any help offered!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.