I've been away for too long from ES query construction
I'm trying to do a simple query that returns buckets in an aggregation of a string term, for each bucket I would like the unique value of another aggregatable string term but wondering how to obtain this...
sample query:
{
"query": {
"term": { "event": "some-value" }
},
"size": 0,
"aggs": {
"user": {
"terms": { "field": "user" }
}
}
}
which returns buckets of users like:
{
"took": 789,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 369,
"max_score": 0,
"hits": []
},
"aggregations": {
"user": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 1,
"buckets": [
{
"key": "user1",
"doc_count": 285
},
{
"key": "user2",
"doc_count": 29
},
{
"key": "user3",
"doc_count": 15
},
{
"key": "user4",
"doc_count": 10
},
{
"key": "user5",
"doc_count": 8
}
]
}
}
}
Any hints appreciated, TIA!