Missing aggregation with value

Elastic Stack Elasticsearch
1

Below is the structure of a document that I've indexed into elasticsearch 6.7

{
	"instance": {
		"id": 1,
		...
		"relatedInstances": [
			{
				"id": 101,
				...
				"instFields": [
					{
						"sourceFieldId": 202,
						"fieldValue": "some value"
					},
					{
						"sourceFieldId": 505,
						"fieldValue": "some value"
					},
					...					
				]
			},
			...
		]
	}
}

  • A document can have different instance.relatedInstances.instFields.sourceFieldIds and if a document doesn't have a particular instance.relatedInstances.instFields.sourceFieldId then it is not included in the document.

  • I'm trying to do an aggregation(count) on instance.relatedInstances.instFields.sourceFieldId for all the instances that has the
    instance.relatedInstances.instFields.sourceFieldId value 202.

  • I also need to include the count of instances that doesn't have instance.relatedInstances.instFields.sourceFieldId with value 202

I tried with the following query,

"aggs": {
    "missing-count": {
      "missing": {
		"field": "instance.relatedInstances.instFields.sourceFieldId",
		"value": "202"
      }
    }                     
}

and got the error [missing] unknown field [value], parser not found.

As per the [documentation][1] missing field can be specified, but it doesn't show how to find documents that doesn't have a field with a specific value.

Appreciate any help to solve this problem.
[1]: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-missing-aggregation.html

2

The missing aggregation is to find documents that are completely lacking a particular field, not that they don't have specific value.

You'll want to use a bool query with a "must_not" clause to find documents that do not have a specific value. That can either go in the "query" section of the search request, or inside a filter aggregation.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.