Querying array of obejcts

Elastic Stack Elasticsearch
1

Hi,

I have a field in my source that have the value:

[{"valid":true,"parser_message":[{"message_type":"INFO","description":"IP
Address from this hit was anonymized to 166.78.33.0."}],"hit":"POST
/debug/collect HTTP/1.1"}]

The following is my mapping, though I'm not sure it is correct

"field_name": {
properties: {
valid: {type: "boolean"},
hit: {
type: "string",
norms: {
enabled: true
},
fields: {
raw: {
type: "string",
index:"not_analyzed"
}
}
},
parser_messages: {
properties: {
message_type: {type: "string"},
description: {
type: "string",
norms: {
enabled: false
},
fields: {
raw: {
type: "string",
index:"not_analyzed"
}
}
},
parameter: {type: "string"}
}
}
}
}

I'm trying to get a count of all unique descriptions. I won't really need
to return the group parser_messages objects so I'm not sure nested objects
were needed.

What would a query look like for this?

I was trying

{
"aggs" : {
"field_name" : {
"terms" : {"field" : "field_name"},

          "aggs" : {
              "description_count" :  {
                "terms" : { "field" : "field_name.hit.raw" }
              }
          }
       }

  }

}

However doesn't return any results and I'm sure there is data for this
field.

Any help would be much appreciated.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/f8191ac6-8c60-4323-9b34-e81db6366a1f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.