The slash char in the document that may lead to unexpected result

Elastic Stack Elasticsearch
1

Elasticsearch version:
Newest

Plugins installed: []
None

JVM version:

OS version:
Redhat Linux

Description of the problem including expected versus actual behavior:
I want to got the sum for each type of downloads field. That totally likes "select sum(num) from Table group by downloads" in mysql db.

For now, My document in Index likes the following:
{
"_index": "sino-564dbf686a67a515-87ae118af4eb61b8-day",
"_type": "downloads",
"_id": "AVbKDizkMS2EvdplxWkF",
"_score": 4.1279697,
"_source": {
"downloads": "/data/attachment/file/20130820/Sinogrid1.pdf",
"date": 20160826,
"num": 1
}
},
{
"_index": "sino-564dbf686a67a515-87ae118af4eb61b8-day",
"_type": "downloads",
"_id": "AVbKkkYaMS2EvdplxpFh",
"_score": 4.1279697,
"_source": {
"downloads": "/data/attachment/file/20130820/Sinogrid2.pdf",
"date": 20160826,
"num": 1
}
},
{
"_index": "sino-564dbf686a67a515-87ae118af4eb61b8-day",
"_type": "downloads",
"_id": "AVbKkhA3MS2EvdplxpFg",
"_score": 3.8407266,
"_source": {
"downloads": "/data/attachment/file/20130820/Sinogrid2.pdf",
"date": 20160826,
"num": 3
}
},

Then, I'd like to search the sum count for each type of downloads filed. my expected return should be like this:
/data/attachment/file/20130820/Sinogrid1.pdf 1
/data/attachment/file/20130820/Sinogrid2.pdf 4

My search:
GET /day/downloads/_search
{
"aggs": {
"res": {
"terms": {
"field": "downloads"
},
"aggs": {
"sum": {
"sum": {
"field": "num"
}
}
}
}
}
}

But the return data is :
"aggregations": {
"res": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 64,
"buckets": [
{
"key": "attachment",
"doc_count": 75,
"sum": {
"value": 109
}
},
{
"key": "data",
"doc_count": 75,
"sum": {
"value": 109
}
},
{
"key": "file",
"doc_count": 75,
"sum": {
"value": 109
}
},
{
"key": "pdf",
"doc_count": 72,
"sum": {
"value": 106
}
},
{
"key": "20130820",
"doc_count": 46,
"sum": {
"value": 58
}
},
{
"key": "sinogrid2",
"doc_count": 12,
"sum": {
"value": 35
}
},
{
"key": "20131212",
"doc_count": 11,
"sum": {
"value": 34
}
},
{
"key": "sinogrid10",
"doc_count": 9,
"sum": {
"value": 18
}
},
{
"key": "20131119",
"doc_count": 5,
"sum": {
"value": 5
}
},
{
"key": "sinogrid1",
"doc_count": 5,
"sum": {
"value": 5
}
}
]
}

You can see that my downloads fields was separated by default.
is it a issue? or any help on it?

2

This is because the downloads field is analyzed (i.e. split into tokens suitable for searches). URLs should typically not be analyzed which is a setting that can be made in the mappings of an index. Please read about mappings and analysis of strings in the documentation.

3

Thanks for your quickly response.
I will refer to documentation as soon as possible and do next action to resolve this issue to try.

BIG thanks