Hi,
I am trying to build a Terms bucket aggregation that also includes documents with the term missing. What I'm finding is, without adding a .missing()
, as you would expect, any documents missing the term are not included in the results. However, if add the .missing("Unknown")
clause to the builder I then the only bucket I get back is for documents with that term missing. How do I combine the two to get both?
Interestingly, if I set a breakpoint in the code and cut and paste the generated JSON into Postman and fire it off - I get the data back as I would expect: with all terms and the missing one included as 'Unknown'.
Any pointers would be much appreciated. Here is the code I am trying:
AggregationBuilder aggregation =
AggregationBuilders
.terms("by_typename")
.missing("Unknown") <-- With this added only missing are returned
.field("typename")
.size(500)
.order(BucketOrder.key(true))
.minDocCount(0)
.subAggregation(
AggregationBuilders.dateHistogram("by_time")
.field("@timestamp")
.dateHistogramInterval(DateHistogramInterval.MONTH)
.extendedBounds(new ExtendedBounds("now-" + time + "M", "now"))
.format("epoch_millis")
.minDocCount(0)
);
Thanks.