Sub aggregation of partial Existent field

Elastic Stack Elasticsearch
1

I have a nested aggregation where just some of the sub aggregation fields exist (geo.country). Therefore I'm not getting any data at all, including for main aggregation field (partners).
Is it possible to the preform this sort of aggregation without creating artificial field with null or empty string value for each document which doesn't have this field?

{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "@timestamp": {
              "gte": "2017-06-04T00:00:00",
              "lte": "2017-06-04T23:59:59"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "partners": {
      "terms": {
        "field": partners",
        "size": 0
      },
      "aggs": {
        "scountry": {
          "terms": {
            "field": "geo.country",
            "size": 0
          },
          "aggs": {
            "impressions": {
              "value_count": {
                "field": "auction.dsp._id"
              }
            }
          }
        }
      }
    }
  }
}
2

I'm not entirely sure I understand... could you show an aggregation response that has the problem you're talking about? Are you trying to avoid "empty" buckets which don't contain any documents?

3

I'm talking about children aggregation: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-children-aggregation.html

Let's assume for example I have 3 fields: states, countries and cities. I want to aggregate for each state all the documents with country field which under this state and under each country all the documents with cities related to it. However, let's assume that for the state of New York I got today only documents with cities and none documents with state. In this scenario I won't get 0 results under New York state even thought I got cities documents. That is because you can't aggregate non existent fields.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.