How can I merge the results of two aggregations?

Elastic Stack Elasticsearch
1

In the example below, I ask elasticsearch for two aggregations (I've
simplified it, it's actually got some nested aggregations in there).

{
"aggregations": {
"agg1": {
"terms": {
"field": "forname"
}
},
"agg2": {
"terms": {
"field": "surname"
}
}
}
}

What I get back is two sets of results, i.e.

{
"aggregations" : {
"agg1" : {
"buckets" : [ {
"key" : "john",
"doc_count" : 1
}, {
"key" : "bob",
"doc_count" : 4
} ]
},
"agg2" : {
"buckets" : [ {
"key" : "smith",
"doc_count" : 3
}, {
"key" : "jones",
"doc_count" : 2
} ]
}
}
}

What I'd like to get back is one set of results. I.e. a list of terms
appearing in either of the fields, with the counts summed across both, e.g.

{
"aggregations" : {
"agg1 OR agg2" : {
"buckets" : [ {
"key" : "john",
"doc_count" : 1
}, {
"key" : "bob",
"doc_count" : 4
}, {
"key" : "smith",
"doc_count" : 3
}, {
"key" : "jones",
"doc_count" : 2
} ]
}
}
}

Is there any way of doing this? I could request them and merge them in my
own code, but if there's a built in way then I'd rather use that.

Thanks,

Tim.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/731d5734-25ff-4d29-ad11-3a9f6a382244%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

You could use bool query and let Elasticsearch do the rest.

On Wednesday, December 18, 2013 3:58:07 PM UTC+7, Tim S wrote:

In the example below, I ask elasticsearch for two aggregations (I've
simplified it, it's actually got some nested aggregations in there).

{
"aggregations": {
"agg1": {
"terms": {
"field": "forname"
}
},
"agg2": {
"terms": {
"field": "surname"
}
}
}
}

What I get back is two sets of results, i.e.

{
"aggregations" : {
"agg1" : {
"buckets" : [ {
"key" : "john",
"doc_count" : 1
}, {
"key" : "bob",
"doc_count" : 4
} ]
},
"agg2" : {
"buckets" : [ {
"key" : "smith",
"doc_count" : 3
}, {
"key" : "jones",
"doc_count" : 2
} ]
}
}
}

What I'd like to get back is one set of results. I.e. a list of terms
appearing in either of the fields, with the counts summed across both, e.g.

{
"aggregations" : {
"agg1 OR agg2" : {
"buckets" : [ {
"key" : "john",
"doc_count" : 1
}, {
"key" : "bob",
"doc_count" : 4
}, {
"key" : "smith",
"doc_count" : 3
}, {
"key" : "jones",
"doc_count" : 2
} ]
}
}
}

Is there any way of doing this? I could request them and merge them in my
own code, but if there's a built in way then I'd rather use that.

Thanks,

Tim.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/8e57316e-2c43-40cc-913e-6f9579fc0410%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

3

How can I use bool query on the result of an aggregation? I want both
aggregations to independently facet on the whole index, then merge the
results. I can see how I would use a bool query to limit the set of docs
I'm aggregating on, but I can't see how I would use it to merge the results
of two aggregations?

Thanks,

Tim.

On Wednesday, December 18, 2013 4:40:37 PM UTC, kidkid wrote:

You could use bool query and let Elasticsearch do the rest.

Elasticsearch Platform — Find real-time answers at scale | Elastic

On Wednesday, December 18, 2013 3:58:07 PM UTC+7, Tim S wrote:

In the example below, I ask elasticsearch for two aggregations (I've
simplified it, it's actually got some nested aggregations in there).

{
"aggregations": {
"agg1": {
"terms": {
"field": "forname"
}
},
"agg2": {
"terms": {
"field": "surname"
}
}
}
}

What I get back is two sets of results, i.e.

{
"aggregations" : {
"agg1" : {
"buckets" : [ {
"key" : "john",
"doc_count" : 1
}, {
"key" : "bob",
"doc_count" : 4
} ]
},
"agg2" : {
"buckets" : [ {
"key" : "smith",
"doc_count" : 3
}, {
"key" : "jones",
"doc_count" : 2
} ]
}
}
}

What I'd like to get back is one set of results. I.e. a list of terms
appearing in either of the fields, with the counts summed across both, e.g.

{
"aggregations" : {
"agg1 OR agg2" : {
"buckets" : [ {
"key" : "john",
"doc_count" : 1
}, {
"key" : "bob",
"doc_count" : 4
}, {
"key" : "smith",
"doc_count" : 3
}, {
"key" : "jones",
"doc_count" : 2
} ]
}
}
}

Is there any way of doing this? I could request them and merge them in my
own code, but if there's a built in way then I'd rather use that.

Thanks,

Tim.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/b9c82b3b-c8a3-4783-96d8-b4d07809189f%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

4

Hi sorry, it would be my mistake:

Could you take a look at
OrFilter: Elasticsearch Platform — Find real-time answers at scale | Elastic

In your case I think you could use match all query & use OrFilter & let ES
merge the result.

On Thursday, December 19, 2013 2:29:06 AM UTC-8, Tim S wrote:

How can I use bool query on the result of an aggregation? I want both
aggregations to independently facet on the whole index, then merge the
results. I can see how I would use a bool query to limit the set of docs
I'm aggregating on, but I can't see how I would use it to merge the results
of two aggregations?

Thanks,

Tim.

On Wednesday, December 18, 2013 4:40:37 PM UTC, kidkid wrote:

You could use bool query and let Elasticsearch do the rest.

Elasticsearch Platform — Find real-time answers at scale | Elastic

On Wednesday, December 18, 2013 3:58:07 PM UTC+7, Tim S wrote:

In the example below, I ask elasticsearch for two aggregations (I've
simplified it, it's actually got some nested aggregations in there).

{
"aggregations": {
"agg1": {
"terms": {
"field": "forname"
}
},
"agg2": {
"terms": {
"field": "surname"
}
}
}
}

What I get back is two sets of results, i.e.

{
"aggregations" : {
"agg1" : {
"buckets" : [ {
"key" : "john",
"doc_count" : 1
}, {
"key" : "bob",
"doc_count" : 4
} ]
},
"agg2" : {
"buckets" : [ {
"key" : "smith",
"doc_count" : 3
}, {
"key" : "jones",
"doc_count" : 2
} ]
}
}
}

What I'd like to get back is one set of results. I.e. a list of terms
appearing in either of the fields, with the counts summed across both, e.g.

{
"aggregations" : {
"agg1 OR agg2" : {
"buckets" : [ {
"key" : "john",
"doc_count" : 1
}, {
"key" : "bob",
"doc_count" : 4
}, {
"key" : "smith",
"doc_count" : 3
}, {
"key" : "jones",
"doc_count" : 2
} ]
}
}
}

Is there any way of doing this? I could request them and merge them in
my own code, but if there's a built in way then I'd rather use that.

Thanks,

Tim.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/0c8d436c-c244-4cac-8ae1-efa75583667a%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

5

Sorry, maybe I'm missing something. Afaics the OR filter would operate on
filters or queries, not on aggregations. Can you give me an example of how
I'd use this to merge the result of the two aggregations?

Thanks.

On Friday, December 20, 2013 2:54:14 AM UTC, kidkid wrote:

Hi sorry, it would be my mistake:

Could you take a look at OrFilter:
Elasticsearch Platform — Find real-time answers at scale | Elastic

In your case I think you could use match all query & use OrFilter & let ES
merge the result.

On Thursday, December 19, 2013 2:29:06 AM UTC-8, Tim S wrote:

How can I use bool query on the result of an aggregation? I want both
aggregations to independently facet on the whole index, then merge the
results. I can see how I would use a bool query to limit the set of docs
I'm aggregating on, but I can't see how I would use it to merge the results
of two aggregations?

Thanks,

Tim.

On Wednesday, December 18, 2013 4:40:37 PM UTC, kidkid wrote:

You could use bool query and let Elasticsearch do the rest.

Elasticsearch Platform — Find real-time answers at scale | Elastic

On Wednesday, December 18, 2013 3:58:07 PM UTC+7, Tim S wrote:

In the example below, I ask elasticsearch for two aggregations (I've
simplified it, it's actually got some nested aggregations in there).

{
"aggregations": {
"agg1": {
"terms": {
"field": "forname"
}
},
"agg2": {
"terms": {
"field": "surname"
}
}
}
}

What I get back is two sets of results, i.e.

{
"aggregations" : {
"agg1" : {
"buckets" : [ {
"key" : "john",
"doc_count" : 1
}, {
"key" : "bob",
"doc_count" : 4
} ]
},
"agg2" : {
"buckets" : [ {
"key" : "smith",
"doc_count" : 3
}, {
"key" : "jones",
"doc_count" : 2
} ]
}
}
}

What I'd like to get back is one set of results. I.e. a list of terms
appearing in either of the fields, with the counts summed across both, e.g.

{
"aggregations" : {
"agg1 OR agg2" : {
"buckets" : [ {
"key" : "john",
"doc_count" : 1
}, {
"key" : "bob",
"doc_count" : 4
}, {
"key" : "smith",
"doc_count" : 3
}, {
"key" : "jones",
"doc_count" : 2
} ]
}
}
}

Is there any way of doing this? I could request them and merge them in
my own code, but if there's a built in way then I'd rather use that.

Thanks,

Tim.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/067e2d3e-2d7f-46e9-9ce6-0384a9a89b43%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

6

You can use scripts to run aggregations on the union of two fields. Here is
an example:

GET /test/_search
{
"aggregations": {
"name" : {
"terms" : {
"script": "_doc['firstname'].values +
_doc['lastname'].values"
}
}
}
}

Another alternative would be to index both first names and last names in a
single 'name' field and to run the aggregation on this field at search
time. Although this would require more disk space, this would also be
faster.

On Fri, Dec 20, 2013 at 10:53 AM, Tim S timstibbs@gmail.com wrote:

Sorry, maybe I'm missing something. Afaics the OR filter would operate on
filters or queries, not on aggregations. Can you give me an example of how
I'd use this to merge the result of the two aggregations?

Thanks.

On Friday, December 20, 2013 2:54:14 AM UTC, kidkid wrote:

Hi sorry, it would be my mistake:

Could you take a look at OrFilter: Elasticsearch Platform — Find real-time answers at scale | Elastic
elasticsearch/reference/current/query-dsl-or-filter.html

In your case I think you could use match all query & use OrFilter & let
ES merge the result.

On Thursday, December 19, 2013 2:29:06 AM UTC-8, Tim S wrote:

How can I use bool query on the result of an aggregation? I want both
aggregations to independently facet on the whole index, then merge the
results. I can see how I would use a bool query to limit the set of docs
I'm aggregating on, but I can't see how I would use it to merge the results
of two aggregations?

Thanks,

Tim.

On Wednesday, December 18, 2013 4:40:37 PM UTC, kidkid wrote:

You could use bool query and let Elasticsearch do the rest.

Elasticsearch Platform — Find real-time answers at scale | Elastic
reference/current/query-dsl-bool-query.html

On Wednesday, December 18, 2013 3:58:07 PM UTC+7, Tim S wrote:

In the example below, I ask elasticsearch for two aggregations (I've
simplified it, it's actually got some nested aggregations in there).

{
"aggregations": {
"agg1": {
"terms": {
"field": "forname"
}
},
"agg2": {
"terms": {
"field": "surname"
}
}
}
}

What I get back is two sets of results, i.e.

{
"aggregations" : {
"agg1" : {
"buckets" : [ {
"key" : "john",
"doc_count" : 1
}, {
"key" : "bob",
"doc_count" : 4
} ]
},
"agg2" : {
"buckets" : [ {
"key" : "smith",
"doc_count" : 3
}, {
"key" : "jones",
"doc_count" : 2
} ]
}
}
}

What I'd like to get back is one set of results. I.e. a list of terms
appearing in either of the fields, with the counts summed across both, e.g.

{
"aggregations" : {
"agg1 OR agg2" : {
"buckets" : [ {
"key" : "john",
"doc_count" : 1
}, {
"key" : "bob",
"doc_count" : 4
}, {
"key" : "smith",
"doc_count" : 3
}, {
"key" : "jones",
"doc_count" : 2
} ]
}
}
}

Is there any way of doing this? I could request them and merge them in
my own code, but if there's a built in way then I'd rather use that.

Thanks,

Tim.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/067e2d3e-2d7f-46e9-9ce6-0384a9a89b43%40googlegroups.com
.

For more options, visit https://groups.google.com/groups/opt_out.

--
Adrien Grand

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j4VLK-NQbREqtTwVeDC%3DrTgTcWfyxjeWmF_uL%3DeJsus6A%40mail.gmail.com.
For more options, visit https://groups.google.com/groups/opt_out.

7

I have not looked at aggs but term facet can run against multiple fields.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/e37b88d6-9a48-4d5f-9787-2ad615eb574d%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.