Values are not showing correctly when used aggs sort

Elastic Stack Elasticsearch
1

Hello,

I have one index named master_db, in that i have fetched one column from db named content_type.
I am using aggs to sort values of content _type as below:

GET /master_db/_search?size=0
{
	"aggs":{
		"group_by":{
			"terms":{
				"field":"content_type",
				"order":{
					"_count":"asc"
				},
				"size":25
			}
		}
	}
}

And i am getting results like:

"aggregations" : {
"group_by" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "ticket",
"doc_count" : 860764
},
{
"key" : "documentation",
"doc_count" : 62753
},
{
"key" : "solution",
"doc_count" : 27574
},
{
"key" : "best",
"doc_count" : 23401
},
{
"key" : "practice",
"doc_count" : 23401
},
{
"key" : "and",
"doc_count" : 15306
},
{
"key" : "case",
"doc_count" : 15306
},
{
"key" : "history",
"doc_count" : 15306
},
{
"key" : "learned",
"doc_count" : 15306
},
{
"key" : "lessons",
"doc_count" : 15306
},
{
"key" : "report",
"doc_count" : 9452
},
{
"key" : "training",
"doc_count" : 6915
},
{
"key" : "announcement",
"doc_count" : 4925
},
{
"key" : "page",
"doc_count" : 4401
},
{
"key" : "reference",
"doc_count" : 4401
},
{
"key" : "link",
"doc_count" : 2182
},
{
"key" : "alert",
"doc_count" : 1801
},
{
"key" : "technical",
"doc_count" : 1801
}
]
}
}
}

In above result, we can see reference and page are two different words but it should be one single word with space like reference page. similar to this there are other cases also in the above result.
I want this to print as 1 word and show count as well for the same.
In index also this value is stored as a one word only.
How i can achieve this using aggs sort?

Regards,
Priyanka

2

Hello,

Can anyone help me in this?

Regards,
Priyanka

3

Do not aggregate on fields that are searchable. Only aggregate on keyword fields, which will not show a two term value in two different buckets, but treat it as one.

4

Hello @spinscale,

Thanks for your reply!!
I have tried with above solution. My code is like:

GET /master_db/_search
{
"size": 50,
"aggs": {
"content_type": {
"terms": {
"field": "content_type.keyword"
},
"aggs": {
"content_subtype": {
"terms": {
"field": "content_subtype.keyword"
},
"aggs": {
"average_balance": {
"avg": {
"field": "balance"
}
}
}
}
}
}
}
}

In above code content type and content_subtype are two different fields.
I am getting output like:

"buckets" : [
        {
          "key" : "Ticket",
          "doc_count" : 860764,
          "content_subtype" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [ ]
          }
        },
        {
          "key" : "Documentation",
          "doc_count" : 62753,
          "content_subtype" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 8542,
            "buckets" : [
              {
                "key" : "Procedure",
                "doc_count" : 20184,
                "average_balance" : {
                  "value" : null
                }
              }

under content type, I am getting values for content sub_type.
I do not want my output like this.
I want first content type values should be displayed and after that all the values for content sub_type.

Regards,
Priyanka

5

Hey,

then have two separate aggregations, one for each field, without nesting the one into the other.

--Alex

6

Hello @spinscale,

Thanks for your reply!!!
I have created two separate aggregations, one for each field.
Now i want to search in that using match all. I want to use query in aggs.
My query should match in all the specified fields and depending on that aggregation count should be displayed.
How i can achieve that?

Regards,
Priyanka

7

hey,

you cannot search in an aggregation result, you can however use a filter aggregation to reduce the number of results that get aggregated on. The terms aggregation also allows for filtering values, but that is specific to this aggregation. See https://www.elastic.co/guide/en/elasticsearch/reference/7.6/search-aggregations-bucket-terms-aggregation.html#_filtering_values_4

--Alex

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.