# Want to aggregate and search multiple route\_path as same function

**URL:** https://discuss.elastic.co/t/want-to-aggregate-and-search-multiple-route-path-as-same-function/243804
**Category:** Elasticsearch
**Created:** [August 5, 2020, 3:32am UTC](https://discuss.elastic.co/t/want-to-aggregate-and-search-multiple-route-path-as-same-function/243804 "2020-08-05T03:32:15Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![hanase](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hanase/32/40115_2.png) [@hanase](https://discuss.elastic.co/u/hanase)
#### Post date: [August 5, 2020, 3:32am UTC](https://discuss.elastic.co/t/want-to-aggregate-and-search-multiple-route-path-as-same-function/243804/1 "2020-08-05T03:32:16Z")

</div>

Hi,

here is my DSL,

```auto
GET access-2020.07.29/_search
{
  "query": {
    "match": {
      "route": "PIDInterface"
    }
  },
  "aggs": {
    "route_path": {
      "terms": {
        "field": "route_path.keyword",
        "size": 5
      }
    }
  }
}

```

and result is

```auto
     {
        "_index" : "access-2020.07.29",
        "_type" : "_doc",
        "_id" : "oX5gmXMBAnGKjYXAHIdC",
        "_score" : 1.1738663,
        "_source" : {
          "route" : "PIDInterface",
          "route_path" : "hex/user/3817606/lobby/domain",
          "request_method" : "GET",
          "@timestamp" : "2020-07-29T15:00:13.000000000+08:00"
        }
      },
      {
        "_index" : "access-2020.07.29",
        "_type" : "_doc",
        "_id" : "pH5gmXMBAnGKjYXAHIdC",
        "_score" : 1.1738663,
        "_source" : {
          "route" : "PIDInterface",
          "route_path" : "hex/user/3817609/lobby/domain",
          "request_method" : "GET",
          "@timestamp" : "2020-07-29T15:00:13.000000000+08:00"
        }
      },
      {
        "_index" : "access-2020.07.29",
        "_type" : "_doc",
        "_id" : "pX5gmXMBAnGKjYXAHIdC",
        "_score" : 1.1738663,
        "_source" : {
          "route" : "PIDInterface",
          "route_path" : "hex/user/3817600/lobby/domain",
          "request_method" : "GET",
          "@timestamp" : "2020-07-29T15:00:13.000000000+08:00"
        }
      },
      {
        "_index" : "access-2020.07.29",
        "_type" : "_doc",
        "_id" : "sH5gmXMBAnGKjYXAHIdC",
        "_score" : 1.1738663,
        "_source" : {
          "route" : "PIDInterface",
          "route_path" : "hex/user/217/lobby/domain",
          "request_method" : "GET",
          "@timestamp" : "2020-07-29T15:00:14.000000000+08:00"
        }
      },
      {
        "_index" : "access-2020.07.29",
        "_type" : "_doc",
        "_id" : "x35gmXMBAnGKjYXAHIdC",
        "_score" : 1.1738663,
        "_source" : {
          "route" : "PIDInterface",
          "route_path" : "hex/user/3817621/lobby/domain",
          "request_method" : "GET",
          "@timestamp" : "2020-07-29T15:00:15.000000000+08:00"
        }
      }
~~~
~~~
  "aggregations" : {
    "route_path" : {
      "doc_count_error_upper_bound" : 452,
      "sum_other_doc_count" : 207736,
      "buckets" : [
        {
          "key" : "hex/user/3820157/lobby/domain",
          "doc_count" : 295
        },
        {
          "key" : "hex/user/3515303/lobby/domain",
          "doc_count" : 291
        },
        {
          "key" : "hex/user/3818401/lobby/domain",
          "doc_count" : 290
        },
        {
          "key" : "hex/user/3819824/lobby/domain",
          "doc_count" : 290
        },
        {
          "key" : "hex/user/235/lobby/domain",
          "doc_count" : 289
        },

```

The field `route_path` is same function

I want to search it like

`"route_path" : "hex/user/*/lobby/domain"`

and aggregate result

How should I do in DSL syntax

thank you 😄

---

<div class="post-metadata">

### Author: ![hanase](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hanase/32/40115_2.png) [@hanase](https://discuss.elastic.co/u/hanase)
#### Post date: [August 5, 2020, 3:42am UTC](https://discuss.elastic.co/t/want-to-aggregate-and-search-multiple-route-path-as-same-function/243804/2 "2020-08-05T03:42:34Z")

</div>

I've try `custom analysis`, and DSL is

```auto
PUT 
{
  "settings": {
    "analysis": {
      "analyzer": {
        "query_analyzer": {
          "type": "custom",
          "tokenizer": "split_query",
          "filter": [
            "top1"
          ]
        }
      },
      "filter": {
        "top1": {
          "type": "limit",
          "max_token_count": 1
        }
      },
      "tokenizer": {
        "split_query": {
          "type": "pattern",
          "pattern": "\\?"
        }
      }
    }
  }
}

GET   
{
  "query": {
    "bool": {
      "must": [
        {
          "wildcard": {
            "route_path.keyword": "/hex/user/*"
          }
        }
      ]
    }
  },
  "from": 0,
  "size": 0,
  "aggs" : {
        "genres" : {
            "terms" : { "field" : "path.no_query" }
        }
    }
}

```

But it can't get what i need.

what should i fix my DSL syntax.

or is there a better way to do it ?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 2, 2020, 3:42am UTC](https://discuss.elastic.co/t/want-to-aggregate-and-search-multiple-route-path-as-same-function/243804/3 "2020-09-02T03:42:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.