Terms aggregation in the same document

Elastic Stack Elasticsearch
1

Hi,
Is that possible to count the value of fields in the same document?
for example, i have this data:

"hits": {
    "total": 3,
    "max_score": 1,
    "hits": [
      {
        "_index": "yeela_checks",
        "_type": "doc",
        "_id": "2",
        "_score": 1,
        "_source": {
          "group": "fans",
          "user": [
            {
              "first": "John",
              "last": "Smith"
            },
            {
              "first": "Maria",
              "last": "Williams"
            },
            {
              "first": "Zack",
              "last": "Farro"
            }
          ]
        }
      },
      {
        "_index": "yeela_checks",
        "_type": "doc",
        "_id": "1",
        "_score": 1,
        "_source": {
          "group": "fans",
          "user": [
            {
              "first": "John",
              "last": "Smith"
            },
            {
              "first": "Alice",
              "last": "White"
            }
          ]
        }
      },
      {
        "_index": "yeela_checks",
        "_type": "doc",
        "_id": "3",
        "_score": 1,
        "_source": {
          "group": "fans",
          "user": [
            {
              "first": "John",
              "last": "Smith"
            },
            {
              "first": "John",
              "last": "Smith"
            },
            {
              "first": "John",
              "last": "Smith"
            }
          ]
        }
      }
    ]
  }

and i want to count with terms aggregation the field "user.first.keyword", so I've made this query:

GET yeela_checks/_search
{
  "size": 0,
  "aggs": {
    "users_count": {
      "terms": {
        "field": "user.first.keyword",
        "size": 10,
        "order": {
          "_count": "desc"
        }
      }
    }
  }
}

and the result i get is this:

 "aggregations": {
    "users_count": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "John",
          "doc_count": 3
        },
        {
          "key": "Alice",
          "doc_count": 1
        },
        {
          "key": "Maria",
          "doc_count": 1
        },
        {
          "key": "Zack",
          "doc_count": 1
        }
      ]
    }
  }

I expected to receive for the "John" value the count of 5 and not 3.
How could i do it?

Thanks!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.