Hi,
I have a field in my source that have the value:
[{"valid":true,"parser_message":[{"message_type":"INFO","description":"IP
Address from this hit was anonymized to 166.78.33.0."}],"hit":"POST
/debug/collect HTTP/1.1"}]
The following is my mapping, though I'm not sure it is correct
"field_name": {
properties: {
valid: {type: "boolean"},
hit: {
type: "string",
norms: {
enabled: true
},
fields: {
raw: {
type: "string",
index:"not_analyzed"
}
}
},
parser_messages: {
properties: {
message_type: {type: "string"},
description: {
type: "string",
norms: {
enabled: false
},
fields: {
raw: {
type: "string",
index:"not_analyzed"
}
}
},
parameter: {type: "string"}
}
}
}
}
I'm trying to get a count of all unique descriptions. I won't really need
to return the group parser_messages objects so I'm not sure nested objects
were needed.
What would a query look like for this?
I was trying
{
"aggs" : {
"field_name" : {
"terms" : {"field" : "field_name"},
"aggs" : {
"description_count" : {
"terms" : { "field" : "field_name.hit.raw" }
}
}
}
}
}
However doesn't return any results and I'm sure there is data for this
field.
Any help would be much appreciated.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/f8191ac6-8c60-4323-9b34-e81db6366a1f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.