Игорь, Ваша аггрегация срабатывает:
{
"took" : 7,
"timed_out" : false,
"_shards" : {
"total" : 7,
"successful" : 7,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 8,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"duplicateCount" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "foo",
"doc_count" : 3,
"duplicateDocuments" : {
"hits" : {
"total" : {
"value" : 3,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "test",
"_type" : "_doc",
"_id" : "3",
"_score" : 1.0,
"_source" : {
"name" : "foo"
}
},
{
"_index" : "test",
"_type" : "_doc",
"_id" : "2",
"_score" : 1.0,
"_source" : {
"name" : "foo"
}
},
{
"_index" : "test",
"_type" : "_doc",
"_id" : "1",
"_score" : 1.0,
"_source" : {
"name" : "foo"
}
}
]
}
}
},
{
"key" : "bar",
"doc_count" : 2,
"duplicateDocuments" : {
"hits" : {
"total" : {
"value" : 2,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "test",
"_type" : "_doc",
"_id" : "4",
"_score" : 1.0,
"_source" : {
"name" : "bar"
}
},
{
"_index" : "test",
"_type" : "_doc",
"_id" : "5",
"_score" : 1.0,
"_source" : {
"name" : "bar"
}
}
]
}
}
}
]
}
}
}
в выводе есть поля
"aggregations" : {
"duplicateCount" : {
но когда я запускаю свою таким образом:
GET app_log-*/_search
{
"size": 0,
"aggs": {
"duplicateCount": {
"terms": {
"field": "context.id",
"min_doc_count": 2
},
"aggs": {
"duplicateDocuments": {
"top_hits": {}
}
}
}
}
}
в полученном выводе не вижу aggregations и duplicateCount - а только:
{
"took" : 296,
"timed_out" : false,
"_shards" : {
"total" : 70,
"successful" : 70,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 10000,
"relation" : "gte"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "app_log-2021.04.05-000329",
"_type" : "_doc",
"_id" : "0ZIlongBetiulgqT-mT2",
"_score" : 1.0,
"_source" : {
......
и далее все документы из индекса.
возможно ли это из-за того, что я ищу по context.id - а поле context - имеет тип flattened?