Multiple nested objects stats aggregation

Elastic Stack Elasticsearch
1

I can retrieve docs based on 'And' effect search for multiple nested object. A new problem is how can I count returned result?

Previous nested query returns 2 docs.

Doc 1
    * rank 1: user A
    * rank 2: user B
    * rank 3: user C 

Doc 2
    * rank 1: user A
    * rank 2: user A
    * rank 3: user D

Now I want to count the number of user A in rank 1. It's expected to be 2, but the aggregation search I use returns 3 (because it include rank 2 as well). The aggregation search I use is

{
    "query": { ...query used in the previous 'and' effect thread }
    "aggs": {
        "stats": {
            "nested": {
                "path": "level1tag.level2tag.level3tag"
            },
            "aggs": {
                 "stats": {
                     "nested": {
                         "path": "level1tag.level2tag.level3tag.level4tag"
                     },
                     "aggs": {
                         "count": {
                             "terms": {
                                 "field": "level1tag.level2tag.level3tag.level4tag.level4_attr1.keyword" 
                             }
                         }
                     }
                 }
            }
        }
    }
}

How can I adjust so that I can accurately calculate the result count?

Thanks

2

After digging a bit, following aggs expression seems to do the trick but I am not sure if it's correct.

{
    "query": {
        "nested": {
            "path": "level1tag.level2tag.level3tag",
            "query": {
                "bool": {
                    "filter": {
                        "term": {
                            "level1tag.level2tag.level3tag.level3_attr1.keyword": "value A"
                        }
                    },
                    "must": [
                        {
                            "nested": {
                                "path": "level1tag.level2tag.level3tag.level4tag",
                                "query": {
                                    "bool": {
                                        "must": [
                                             {
                                                 "term": {
                                                     "level1tag.level2tag.level3tag.level4tag.levelt4_attr1.keyword": "value B"
                                                 }
                                             }
                                        ]
                                    }
                                }
                            } 
                        }
                    ]
                }
            }
        }
    },
    "aggs": {
        "group_by_level3tag": {
            "nested": {
                "path": "level1tag.level2tag.level3tag"
            },
            "aggs": {
                "group_by_level3_attr1": {
                    "terms": {
                        "field": "level1tag.level2tag.level3tag.level3_attr1.keyword"
                    },
                    "aggs": {
                        "filter_by_level4tag": {
                            "filter": {
                                "nested": {
                                    "path": "level1tag.level2tag.level3tag.level4tag",
                                    "query": {
                                        "bool": {
                                            "filter": {
                                                "term": {
                                                    "level1tag.level2tag.level3tag.level4tag.level4_attr1.keyword": "value B" 
                                                }  
                                            }
                                        }
                                    }
                                }
                            } 
                        }
                    }
                }
            }
        }
    }
}
3

What do your json documents look like? It's unclear to me how you go from rank/user to levelXtag.

4

Sorry my bad. Didn't notice that was too abstract. The docs returned its structure should look like one below (Apologize I do not have data at hand so based on my memory if it serves correctly)

level1tag : {
    ... other attrs or tags
    level2tag: {
        ... other attrs or tags 
        level3tag: {
            level3_attr1: "value A"
            level4tag: {
                level4_attr1: "value B"
                ... other attrs or tags 
            }
            ... other attrs or tags                 
        }
    }
}

So the returned stats

"aggregations": {
    "group_by_level3tag": {
        "doc_count": 6,
        "group_by_level4_attr1": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
                { 
                    "key": "rank 3",
                    "doc_count": 2,
                    "filter_by_level4_attr1": {
                        "doc_count": 0
                    }
                },
                { 
                    "key": "rank 1",
                    "doc_count": 2,
                    "filter_by_level4_attr1": {
                        "doc_count": 2
                    }
                },
                { 
                    "key": "rank 2",
                    "doc_count": 2,
                    "filter_by_level4_attr1": {
                        "doc_count": 1
                    }
                }
            ]
        }
   }
}
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.