Sub aggregation

Elastic Stack Elasticsearch
1

Hi,
i am trying to group all the visited product by each user.
when i execute this aggregation:

 {
  "size":0,
  "aggs" : {
  "distinctroles": {
   "terms": {
    "field": "roles"
   },
   "aggs": {
    "consultedproducts": {
   "terms": {
   "field": "productcode"
      }
     }
   }
  }
 }
}

it returns all the roles and all the products:

 "buckets": [
        {
      "key": "role_customergroup",
      "doc_count": 3124,
      "consultedproducts": {
        "doc_count_error_upper_bound": 0,
        "sum_other_doc_count": 0,
        "buckets": [
          {
            "key": "847942",
            "doc_count": 639
          },
          {
            "key": "1312640",
            "doc_count": 438
          },
          {
            "key": "458542",
            "doc_count": 438
          },
          {
            "key": "1992695",
            "doc_count": 224
          },
          {
            "key": "872912",
            "doc_count": 219
          },
          {
            "key": "2938458",
            "doc_count": 217
          },
          {
            "key": "4812254",
            "doc_count": 214
          },
          {
            "key": "824267",
            "doc_count": 214
          },
          {
            "key": "1776947",
            "doc_count": 205
          },
          {
            "key": "805693",
            "doc_count": 110
          }
        ]
      }
    },
    {
      "key": "role_pronto",
      "doc_count": 1945,
      "consultedproducts": {
        "doc_count_error_upper_bound": 0,
        "sum_other_doc_count": 0,
        "buckets": [
          {
            "key": "847942",
            "doc_count": 639
          },
          {
            "key": "1312640",
            "doc_count": 438
          },
          {
            "key": "458542",
            "doc_count": 438
          },
          {
            "key": "1992695",
            "doc_count": 224
          }
        ]
      }
    }
  }

am I doing something wrong?

2

What are you expecting to see? To get more help it would be helpful to get an idea of how the documents in that index look like. Maybe a sample doc or the mapping would help.

3

this is a doc example:

  {
     "_index": "dashboard",
     "_type": "logs",
    "_id": "AVRS3LjIqZBDXIAH7Wc2",
    "_score": 1,
    "fields": {
      "productcode": [
        "\"1992695\""
      ],
      "roles": [
        "\"ROLE_CUSTOMERGROUP,ROLE_PRONTO\""
      ]
    }
  }

this is a user that has different roles.
that consulted this product "1992695".
I need to get all the consulted products for each role.

I am expecting something like this:

"buckets": [
    {
  "key": "role_customergroup",
  "doc_count": 3124,
  "consultedproducts": {
    "doc_count_error_upper_bound": 0,
    "sum_other_doc_count": 0,
    "buckets": [
      {
        "key": "847942",
        "doc_count": 639
      },
      {
        "key": "1312640",
        "doc_count": 438
      },
      {
        "key": "458542",
        "doc_count": 438
      },
      {
        "key": "872912",
        "doc_count": 219
      },
{
  "key": "role_pronto",
  "doc_count": 1945,
  "consultedproducts": {
    "doc_count_error_upper_bound": 0,
    "sum_other_doc_count": 0,
    "buckets": [
      {
        "key": "1992695",
        "doc_count": 224
      }
    ]
  }
}

}

4

The response structure seems okay, to me, which part of the first response is wrong in your opinion? I you have a document with "productcode" : "1992695" and "roles" : "ROLE_CUSTOMERGROUP,ROLE_PRONTO" it will turn up in both bucket. Is that the problem you are facing?

5

Sorry bro,

it's an internal issue about roles

never mind :smiley: