Return related terms

Elastic Stack Elasticsearch
1

Hi,

Is it possible to do search that returns the terms that occur on a field
that matches my search?

For example, if I have some docs like:

{
"field": "a dog is a great animal"
}

{
"field" : "my favorite animal are cats"
}

{
"field": "what a great animal is my dog"
}

{
"field": "my pet is a cat"
}

I would like my search for animal, to return something like:

{
"field": [ { "term": "dog", "value": 2}, {"term": "cats", "value":1 ]
}

It tells me that, when people talk about animals, they usually talk about
dog(s) or cat(s).
Obviously, in my example I've already filtered "irrelevant" (terms. What
could be accomplished with some kind of filtering inside the query.

I'm planning on using something like this to parse logs, and look for
"hidden" evidences. For example, when filtering my logs by "ssh", I'd like
to see what are the most common terms associated with it (maybe user names,
hosts, failures and so on).

Thanks a lot.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/dbc75f86-b954-447a-bece-5c3a0c1cae30%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

One possible way is to augment your search with a terms aggregation query
on an analyzed version of the field you want to extract the terms from. Be
careful though is this can be very very expensive if you have a field with
lots of distinct terms.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/d9e1bb6f-a2fe-4995-82e3-aa3613677dc3%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

3

Thanks Binh, I've really miss read the Terms Aggregation :slight_smile:

On Monday, June 2, 2014 4:45:18 PM UTC-3, Binh Ly wrote:

One possible way is to augment your search with a terms aggregation query
on an analyzed version of the field you want to extract the terms from. Be
careful though is this can be very very expensive if you have a field with
lots of distinct terms.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/31c42821-c384-41de-aea1-80ea3270fb95%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.