Filters on Aggregation not working

Elastic Stack Elasticsearch
1

Hi all,

I am using ES 1.2.1.

I have the following type of data:

{"splashView":"Y","orderPlaced":"Y","timestamp":"1428402321850","parsed":"true","type":"cpeevent"}
{"splashView":"Y","orderPlaced":"N","timestamp":"1428402322100","parsed":"true","type":"cpeevent"}

The mapping for these fields are:

"splashView":
{
"type": "string",
"store": true,
"analyzer": "standard"
},

"orderPlaced":
{
"type": "string",
"store": true,
"analyzer": "standard"
},

I am performing the following query:

{
"aggs" : {
"splashcount" : {
"filters" : {
"filters" : {
"orderPlaced1" : { "term" : { "orderPlaced" : "Y" }},
"splashView1" : { "term" : { "splashView" : "Y" }}
}
}
}
}
}

But not getting any response:

{
"took": 3,
"timed_out": false,
"_shards":
{
"total": 5,
"successful": 5,
"failed": 0
},
"hits":
{
"total": 11,
"max_score": 1,

"aggregations":
{
"splashcount":
{
"buckets":
{
"orderPlaced1":
{
"doc_count": 0
},
"splashView1":
{
"doc_count": 0
}
}
}
}
}

Can anyone tell me why I am not getting doc count when the data matching
the filter is there?

Regards,
Rakesh Kumar Rakshit

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/1a70b439-ed94-4e8c-a0e9-25d146ea896f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

HI Rakesh,

Term filters do not get passed through the analyzer and so need to specify
the term as it appears in the index. Since you are using the standard
analyzer your orderPlaced and splashView will have Y indexed as y
because the standard analyzer lowercases all terms. This is most likely to
be your issue. You can do one of the following to solve this:

  1. Change your query to reflect the terms as they appear in the index:

{
"aggs" : {
"splashcount" : {
"filters" : {
"filters" : {
"orderPlaced1" : { "term" : { "orderPlaced" : "y" }},
"splashView1" : { "term" : { "splashView" : "y" }}
}
}
}
}
}

  1. Change the mapping on those fields to specify "index": "not_analyzed"
    (more info here
    "Mapping | Elasticsearch: The Definitive Guide [2.x] | Elastic")
    and keep your query the same. Note that this will require that you re-index
    your data as this setting on the mapping cannot be updated on an existing
    index

  2. Use the Boolean field type
    (Field data types | Elasticsearch Guide [8.11] | Elastic).
    Note that this will also require re-indexing your data

Hope this helps,

Colin

On Tuesday, April 7, 2015 at 1:59:57 PM UTC+1, rakesh rakshit wrote:

Hi all,

I am using ES 1.2.1.

I have the following type of data:

{"splashView":"Y","orderPlaced":"Y","timestamp":"1428402321850","parsed":"true","type":"cpeevent"}

{"splashView":"Y","orderPlaced":"N","timestamp":"1428402322100","parsed":"true","type":"cpeevent"}

The mapping for these fields are:

"splashView":
{
"type": "string",
"store": true,
"analyzer": "standard"
},

"orderPlaced":
{
"type": "string",
"store": true,
"analyzer": "standard"
},

I am performing the following query:

{
"aggs" : {
"splashcount" : {
"filters" : {
"filters" : {
"orderPlaced1" : { "term" : { "orderPlaced" : "Y" }},
"splashView1" : { "term" : { "splashView" : "Y" }}
}
}
}
}
}

But not getting any response:

{
"took": 3,
"timed_out": false,
"_shards":
{
"total": 5,
"successful": 5,
"failed": 0
},
"hits":
{
"total": 11,
"max_score": 1,

"aggregations":
{
"splashcount":
{
"buckets":
{
"orderPlaced1":
{
"doc_count": 0
},
"splashView1":
{
"doc_count": 0
}
}
}
}
}

Can anyone tell me why I am not getting doc count when the data matching
the filter is there?

Regards,
Rakesh Kumar Rakshit

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/2737b591-ab70-413b-a368-9af9f2066e16%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

3

Thanks a lot Colin. Changing to lower case helped me.

Regards,
Rakesh

On Tuesday, April 7, 2015 at 7:46:43 PM UTC+5:30, Colin Goodheart-Smithe
wrote:

HI Rakesh,

Term filters do not get passed through the analyzer and so need to specify
the term as it appears in the index. Since you are using the standard
analyzer your orderPlaced and splashView will have Y indexed as y
because the standard analyzer lowercases all terms. This is most likely to
be your issue. You can do one of the following to solve this:

  1. Change your query to reflect the terms as they appear in the index:

{
"aggs" : {
"splashcount" : {
"filters" : {
"filters" : {
"orderPlaced1" : { "term" : { "orderPlaced" : "y" }},
"splashView1" : { "term" : { "splashView" : "y" }}
}
}
}
}
}

  1. Change the mapping on those fields to specify "index": "not_analyzed"
    (more info here "
    Mapping | Elasticsearch: The Definitive Guide [2.x] | Elastic")
    and keep your query the same. Note that this will require that you re-index
    your data as this setting on the mapping cannot be updated on an existing
    index

  2. Use the Boolean field type (
    Field data types | Elasticsearch Guide [8.11] | Elastic).
    Note that this will also require re-indexing your data

Hope this helps,

Colin

On Tuesday, April 7, 2015 at 1:59:57 PM UTC+1, rakesh rakshit wrote:

Hi all,

I am using ES 1.2.1.

I have the following type of data:

{"splashView":"Y","orderPlaced":"Y","timestamp":"1428402321850","parsed":"true","type":"cpeevent"}

{"splashView":"Y","orderPlaced":"N","timestamp":"1428402322100","parsed":"true","type":"cpeevent"}

The mapping for these fields are:

"splashView":
{
"type": "string",
"store": true,
"analyzer": "standard"
},

"orderPlaced":
{
"type": "string",
"store": true,
"analyzer": "standard"
},

I am performing the following query:

{
"aggs" : {
"splashcount" : {
"filters" : {
"filters" : {
"orderPlaced1" : { "term" : { "orderPlaced" : "Y" }},
"splashView1" : { "term" : { "splashView" : "Y" }}
}
}
}
}
}

But not getting any response:

{
"took": 3,
"timed_out": false,
"_shards":
{
"total": 5,
"successful": 5,
"failed": 0
},
"hits":
{
"total": 11,
"max_score": 1,

"aggregations":
{
"splashcount":
{
"buckets":
{
"orderPlaced1":
{
"doc_count": 0
},
"splashView1":
{
"doc_count": 0
}
}
}
}
}

Can anyone tell me why I am not getting doc count when the data matching
the filter is there?

Regards,
Rakesh Kumar Rakshit

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/76ef7773-ff03-4150-886d-c9db00943baa%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.