What is the best approach to combine multiple aggregations based in same key

Elastic Stack Elasticsearch
1

This is the query I am playing with:

    {
    	"aggs": {
    		"by_foo": {
    			"terms": {
    				"field": "foo.keyword",
    				"size": 100,
    				"exclude": [ "Unknown" ]
    			}
    		},
    		"by_bar": {
    			"terms": {
    				"field": "bar.keyword",
    				"size": 100,
    				"exclude": [ "Unknown" ]
    			}
    		}
    	},
    	"query": {
    		"range": {
    			"doc_date": {
    				"gte": "now-1y/d",
    				"lt": "now/d"
    			}
    		}
    	},
    	"size": 0
    }

the result is similar to:

    "aggregations": {
        "by_foo": {
          "doc_count_error_upper_bound": 0,
          "sum_other_doc_count": 6589,
          "buckets": [
            {
              "key": "A",
              "doc_count": 10
            },
            {
              "key": "B",
              "doc_count": 10
            }
          ]
        },
        "by_bar": {
          "doc_count_error_upper_bound": 0,
          "sum_other_doc_count": 11427,
          "buckets": [
            {
              "key": "B",
              "doc_count": 10
            },
            {
              "key": "C",
              "doc_count": 10
            }
          ]
        }
      }

I will like to have something similar to:

     "aggregations": {
        "by_foo_bar": {
          "buckets": [
            {
              "key": "A",
              "doc_count": 10
            },
            {
              "key": "B",
              "doc_count": 20
            },
            {
              "key": "C",
              "doc_count": 10
            },
          ]
        }
      }
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.