Group aggregates by field value

Elastic Stack Elasticsearch
1

Hi,

I am trying to group multiple field values as a single aggregate. My Index consists of file records, each record contains a file extension field.

I need to aggregate the index in a way such that I can group all Word, Powerpoint and Excel documents each in a single aggregate.

This is what I'm trying to achieve:

Word Documents => group aggregate on extensions ".doc", ".docx"
Excel Documents => group aggregate on extensions ".xls", ".xlsx"
Powerpoint Documents => group aggregate on extensions ".ppt", ".pptx"

How can I do that?

2

i would bet on filter aggregation. https://www.elastic.co/guide/en/elasticsearch/reference/1.5/search-aggregations-bucket-filter-aggregation.html , you filter out the documents you want, e.g. word documents and then you aggregate on the extention field. try it and see?

jason