I am trying to build a Terms bucket aggregation that also includes documents with the term missing. What I'm finding is, without adding a
.missing(), as you would expect, any documents missing the term are not included in the results. However, if add the
.missing("Unknown") clause to the builder I then the only bucket I get back is for documents with that term missing. How do I combine the two to get both?
Interestingly, if I set a breakpoint in the code and cut and paste the generated JSON into Postman and fire it off - I get the data back as I would expect: with all terms and the missing one included as 'Unknown'.
Any pointers would be much appreciated. Here is the code I am trying:
AggregationBuilder aggregation = AggregationBuilders .terms("by_typename") .missing("Unknown") <-- With this added only missing are returned .field("typename") .size(500) .order(BucketOrder.key(true)) .minDocCount(0) .subAggregation( AggregationBuilders.dateHistogram("by_time") .field("@timestamp") .dateHistogramInterval(DateHistogramInterval.MONTH) .extendedBounds(new ExtendedBounds("now-" + time + "M", "now")) .format("epoch_millis") .minDocCount(0) );