Unexpected behavior from nested -> filter -> nested aggregation

Elastic Stack Elasticsearch
1

First, let me say I'm very excited about the new aggregations. Great work!

I've got a type with two layers of nesting:

script:
calls: [
name: string
params: [
name: string
value: string
]
]

I want to run an aggregation over the parameter values for calls to a
specific function. Here's the skeleton of what I tried:

'aggs': {'b': {
'nested': {'path': 'calls'},
'aggs': {'c': {
'filter': {'term': {'calls.name': 'particular_func'}},
'aggs': {'d': {
'nested': {'path': 'calls.params'},
'aggs': ...

The structure is three aggregations: a nested wrapping a filter wrapping a
nested. Checking the doc counts on these, I see that the outer two work as
expected: the doc count for the outer nested is the number of nested
"calls" documents, the doc count for the filter is the number of those
nested "calls" docs that pass the filter. But it appears that the inner
nested resets the buckets: it returns the number of inner nested "params"
documents across all "calls" docs, regardless of the filter.

Is there a way to do what I want?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/83666871-22f3-4989-9b76-be822d3cf19c%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

Bumping because I posted this on the weekend to few views. Should I file a
bug report?

On Monday, January 20, 2014 3:55:54 PM UTC-5, John Freeman wrote:

First, let me say I'm very excited about the new aggregations. Great work!

I've got a type with two layers of nesting:

script:
calls: [
name: string
params: [
name: string
value: string
]
]

I want to run an aggregation over the parameter values for calls to a
specific function. Here's the skeleton of what I tried:

'aggs': {'b': {
'nested': {'path': 'calls'},
'aggs': {'c': {
'filter': {'term': {'calls.name': 'particular_func'}},
'aggs': {'d': {
'nested': {'path': 'calls.params'},
'aggs': ...

The structure is three aggregations: a nested wrapping a filter wrapping a
nested. Checking the doc counts on these, I see that the outer two work as
expected: the doc count for the outer nested is the number of nested
"calls" documents, the doc count for the filter is the number of those
nested "calls" docs that pass the filter. But it appears that the inner
nested resets the buckets: it returns the number of inner nested "params"
documents across all "calls" docs, regardless of the filter.

Is there a way to do what I want?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/1be3993e-2df0-4fb5-bbc7-573c3cb59c3d%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

3

I'm jumping into the world of nested filter aggregations. Did you ever
figure this out?

On Tuesday, January 21, 2014 3:15:11 PM UTC-5, John Freeman wrote:

Bumping because I posted this on the weekend to few views. Should I file a
bug report?

On Monday, January 20, 2014 3:55:54 PM UTC-5, John Freeman wrote:

First, let me say I'm very excited about the new aggregations. Great work!

I've got a type with two layers of nesting:

script:
calls: [
name: string
params: [
name: string
value: string
]
]

I want to run an aggregation over the parameter values for calls to a
specific function. Here's the skeleton of what I tried:

'aggs': {'b': {
'nested': {'path': 'calls'},
'aggs': {'c': {
'filter': {'term': {'calls.name': 'particular_func'}},
'aggs': {'d': {
'nested': {'path': 'calls.params'},
'aggs': ...

The structure is three aggregations: a nested wrapping a filter wrapping
a nested. Checking the doc counts on these, I see that the outer two work
as expected: the doc count for the outer nested is the number of nested
"calls" documents, the doc count for the filter is the number of those
nested "calls" docs that pass the filter. But it appears that the inner
nested resets the buckets: it returns the number of inner nested "params"
documents across all "calls" docs, regardless of the filter.

Is there a way to do what I want?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/50159e46-17b9-4ad3-9911-20cbcfe7eae4%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

4

I'm also running into this it is not what I expected. I tried parent/child
and got the same behavior. I expect the filtering to narrow down the
results with each filter. I filter on a child (or nested) that has
property=p then go back to aggregate on the parent and I get all the
results again as if the filter is not applied.

I can include sample data, mapping, and queries if someone wants to comment.

I'm trying to do clickstream analysis on session events and user actions.
The data models I am trying are where the session is the parent event with
user actions as the child (or nested) events. I've tried several different
models and have not found one that works well.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/bbc238d6-9f60-4ede-b311-9d522f930120%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

5

"Lastly, it is not possible to “cross reference” between nested documents.
One nested doc cannot “see” another nested doc’s properties. For example,
you are not able to filter on “A.name” but facet on “B.age”. You can get
around this by using include_in_root, which effectively copies the nested
docs into the root, but this get’s you back to the problems of inner
objects."

Perhaps this is our answer?

On Friday, October 24, 2014 3:31:11 PM UTC-7, Zennet Wheatcroft wrote:

I'm also running into this it is not what I expected. I tried parent/child
and got the same behavior. I expect the filtering to narrow down the
results with each filter. I filter on a child (or nested) that has
property=p then go back to aggregate on the parent and I get all the
results again as if the filter is not applied.

I can include sample data, mapping, and queries if someone wants to
comment.

I'm trying to do clickstream analysis on session events and user actions.
The data models I am trying are where the session is the parent event with
user actions as the child (or nested) events. I've tried several different
models and have not found one that works well.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/24b79787-aa22-4c15-8df1-831149d3f621%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.