# Which aggregation should be used for transform operations on multifield?

**URL:** <https://discuss.elastic.co/t/which-aggregation-should-be-used-for-transform-operations-on-multifield/298409>\
**Category:** Elasticsearch\
**Tags:** transforms\
**Created:** [February 28, 2022, 2:09pm UTC](https://discuss.elastic.co/t/which-aggregation-should-be-used-for-transform-operations-on-multifield/298409 "2022-02-28T14:09:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Scylanth](https://avatars.discourse-cdn.com/v4/letter/s/22d042/32.png) [@Scylanth](https://discuss.elastic.co/u/Scylanth)\
**Post date:** [February 28, 2022, 2:09pm UTC](https://discuss.elastic.co/t/which-aggregation-should-be-used-for-transform-operations-on-multifield/298409/1 "2022-02-28T14:09:57Z")

</div>

Hello,

I am using 7.16.3 Elasticsearch and I am trying to perform a transform aggregation on an index to create a summary index (basically have the same index but with an aggregated timestamp by day to be smaller).

Among the fields I am aggregating, there is a multifield that has this mapping :

```auto
"features" : {
	"fielddata" : true,
		"analyzer" : "feature_analyzer",
		"type" : "text",
		"fields" : {
		"keyword" : {
			"type" : "keyword"
		}
	}
}

```

and this analyzer :

```auto
"analysis" : {
	"analyzer" : {
		"feature_analyzer" : {
			"filter" : [
				"uppercase"
			],
			"tokenizer" : "tilde_tokenizer"
		}
	},
	"tokenizer" : {
		"tilde_tokenizer" : {
			"pattern" : """\~""",
			"type" : "simple_pattern_split"
		}
	}
}

```

For example, if the source is value1~value2, a terms aggregation on features will give two results (value 1 and value 2), and a terms aggregation on features.keyword will output only one (value1~value2).

I need in my transformed index to have the same field with the same content (so the same features value and the same features.keyword value)

The problem is that when I try a terms aggregation using features.keyword, I lose some information as the aggregation is not a text anymore, and I have as a result the non-analyze field.  
A terms aggregation on features does not work either : I have null fields.

What can I do to get the expected results?

---

<div class="post-metadata">

**Author:** ![casterQ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/casterq/32/93257_2.png) [@casterQ](https://discuss.elastic.co/u/casterQ)\
**Post date:** [March 1, 2022, 3:23am UTC](https://discuss.elastic.co/t/which-aggregation-should-be-used-for-transform-operations-on-multifield/298409/2 "2022-03-01T03:23:30Z")

</div>

You'd better not open text type filed with fielddata for agg，because text's fielddata performance is not good after the amount of data comes up.  
You can use split pipeline as below，hope it can meet your needs.

```auto
PUT _ingest/pipeline/pp1
{
  "description": "splitby~",
  "processors": [
    {
      "split": {
        "field": "k1",
        "separator": "~"
      }
    }
  ]
}
PUT cc1
{
  "mappings": {
    "properties": {
      "k1": {
        "type": "keyword"
      }
    }
  }
}
POST cc1/_doc?pipeline=pp1
{
  "k1":"ab"
}
POST cc1/_doc?pipeline=pp1
{
  "k1":"a~b"
}
GET cc1/_search
{
  "aggs": {
    "xxx": {
      "terms": {
        "field": "k1",
        "size": 10
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Scylanth](https://avatars.discourse-cdn.com/v4/letter/s/22d042/32.png) [@Scylanth](https://discuss.elastic.co/u/Scylanth)\
**Post date:** [March 4, 2022, 4:33pm UTC](https://discuss.elastic.co/t/which-aggregation-should-be-used-for-transform-operations-on-multifield/298409/3 "2022-03-04T16:33:24Z")

</div>

I can't rely on ingest here for two reasons. The first one is that I need the same exact mapping than the original index, and because I do not think that transform operations use pipelines.

However I was able to solve my issue by creating the index with an index template before launching the transform operation.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 1, 2022, 4:33pm UTC](https://discuss.elastic.co/t/which-aggregation-should-be-used-for-transform-operations-on-multifield/298409/4 "2022-04-01T16:33:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.