Total doc_count aggregations

Elastic Stack Elasticsearch
1

I am looking for a way to sum up the Total doc_count aggregations that I have defined in the query. I will try to explain my question through the following simple representative example:

 {
      "name" : false,
      "surname" : false
    
  },
  {
      "name" : false,
      "surname" : false
  }

Query:

GET index/_search?size=0
{"query": {
  "bool": {
    "must": [
      {"term": {"name": false}},
      {"term": {"surname": false}}
    ]
  }
},
  "aggs": {
    "name": {
      "terms": {
        "field": "name"
      }
    },
    "surname": {
      "terms": {
        "field": "surname"
      }
    }
  }
}

The query returns the value for each field " name " and " surname " with value "false".

  "aggregations" : {
    "name" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : 0,
          "key_as_string" : "false",
          "doc_count" : 2 <---------
        }
      ]
    },
    "surname" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : 0,
          "key_as_string" : "false",
          "doc_count" : 2 <---------
        }
      ]
    }
  }
}

Is it possible to return the total sum of doc_count, so that in this situation it would be "doc_count" : 2 + "doc_count" : 2 == 4 ?
If I get the total doc_count, it would reduce a lot of GET in the process of querying the data.
I've been trying to do it with script but since they are boolean values it doesn't work.

2

Hi,

You may obtain the value by using Sum Bucket Aggregation.

But with the shared query, I suppose documents with 'name' == false AND 'surname' ==false will match and doc_count in 'name' aggregation and doc_count in 'surname' aggregation must be the same. Is it your intent?
If you want to query OR, you may use "should" clause and "minimum_should_match" parameter in Boolean query.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.