So I have data that looks roughly like this:
{
"tags": [
"date=09/26/18",
"member=Y",
"type=newsletter",
"type=call"
]
}
I am making use of the fields mapping to create two additional fields:
tags.key
tags.val
So for the string "member=Y"
tags.key ends up containing the prefix: "member"
tags.val ends up containing the suffix: "Y"
I would like to perform an aggregation that give me back an aggregation of keys, with each of their values.
Something that would look roughly like this, or similar:
{
"aggregations": {
"key_agg": {
"buckets": [{
"key": "type",
"doc_count": 121724,
"key_tag_agg": {
"buckets": [{
"key": "call",
"doc_count": 59025
}, {
"key": "newsletter",
"doc_count": 58637
}]
}
}]
}
}
}
Instead, whenever I try I seem to get every single permutation for each key field:
{
"aggregations": {
"key_agg": {
"buckets": [{
"key": "member",
"doc_count": 121724,
"key_tag_agg": {
"buckets": [{
"key": "type=call",
"doc_count": 59025
}, {
"key": "type=newsletter",
"doc_count": 58637
}, {
"key": "tenure=24",
"doc_count": 508637
}, {
"key": "date=9/27/2018",
"doc_count": 49943
}, {
"key": "date=10/03/2018",
"doc_count": 49413
}, {
"key": "member=Y",
"doc_count": 45549
}]
}
}]
}
}
}
You can see above that even though we are aggregating the keys, and that bucket is for key "type", it still gives values such as "member=Y", even though it doesn't start with "type".
I've tried things like:
"aggs": {
"categories": {
"terms": {
"field": "tags.key"
},
"aggs": {
"categories": {
"terms": {
"field": "tags.val"
}
}
}
}
}
And also tried scripting:
"aggs": {
"categories": {
"terms": {
"field": "tags.key"
},
"aggs": {
"categories": {
"terms": {
"script": {
"lang": "painless",
"source": """
if (doc['tags'].value.startsWith(doc['tags.key'].value)) {
return doc['tags'].value
}
return ''
"""
}
}
}
}
}
}
Is there any potential solution for me?
I can use painless scripts, but no other scripting is available.
thanks,
Chris