Hello @ntsh999,
The "easiest" solution is using scripted fields
, but it is gonna to be slow and consume resources, as you're accessing to the _source
:
GET your_index_name/_search
{
"script_fields": {
"number_of_breaches": {
"script": {
"source": "params['_source'].breaches.length"
}
}
},
"_source": {
"excludes": [ "breaches" ]
}
}
# Response
{
"took" : 672,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 1,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "mytest",
"_type" : "_doc",
"_id" : "1",
"_score" : 1.0,
"_source" : {
"contact" : 9899999999,
"name" : "xyx",
"age" : 45,
"email" : ""
},
"fields" : {
"number_of_breaches" : [
1
]
}
}
]
}
}
The best solution is usually to compute such fields at indexing time, for example using the Ingest Pipelines (documentation):
PUT _ingest/pipeline/count_breaches
{
"description": "Counts the breaches",
"processors": [
{
"script": {
"source": "ctx.number_of_breaches = ctx.containsKey('breaches') ? ctx.breaches.length : 0"
}
}
]
}
The pipeline can be used when indexing the document.