How can I have an review of my index content on a specific field?

[vic22]

Hello everyone !
I hope that you have a great day!
I would like to ask you a particular question. It sounds easy, but, in contrario, it is quite complex...

In my Elasticsearch index, I would like to know for a specific field, what are all the possible values , for exemple, if my field is named "user", I want to know what are all the users referenced in this field ?

Thanks, in advance, for your answers!

Vic22

[ylasri (Yassine LASRI)]

You can use cardinality aggs to get an idea on how many unique values

GET my-index/_search
{
  "size": 0,
  "aggs": {
    "user_count": {
      "cardinality": {
        "field": "user",
        "precision_threshold": 100
      }
    }
  }
}

Then use a term aggs to retrieve all possible values

GET my-index/_search
{
  "size": 0,
  "aggs": {
    "users_buckets": {
      "terms": {
        "field": "user",
        "size": 1000
      }
    }
  }
}

[vic22]

[quote="ylasri, post:2, topic:241297"]

GET my-index/_search
{
  "size": 0,
  "aggs": {
    "user_count": {
      "cardinality": {
        "field": "user",
        "precision_threshold": 100
      }
    }
  }
}

Ok, thank you !

[ylasri (Yassine LASRI)]

Or simply use the Data Visualiser under Machine Learning in Kibana to explore your index
That will give you an overview on your index

[vic22]

I do not have yet Kibana, I am only requesting Elasticsearch in curl command. But I will remember your advise. Again Thank You !