Elasticsearch filter/count nested fields

Question

I have documents with a nested field that looks like this:

...
"results": [
  {
    "id": "1234",
    "name": "asdf"
  },
  {
    "id": "5678",
    "name": "jklö"
  }
],
"ip": "1.2.3.4"
...

The mapping for the nested field looks like this:

"results": {
  "type": "nested",
  "properties": {
    "id": {
      "type": "string"
    },
    "name": {
      "type": "string"
    }
  }
}

Before I switched to elasticsearch 2 I had a query with aggs that counted the documents that had no results. Here's the aggregation part of the query:

"aggs": {
  "no_result": {
    "filter": {
      "missing": {
        "field": "results"
      }
    },
    "aggs": {
      "count": {
        "value_count": {
          "field": "ip"
        }
      }
    }
  }
}

Now that I switched to elasticserach 2 it just counts all documents. I already tried different things like counting all documents and counting results so that I can subtract the results but

"aggs": {
  "results_count": {
    "value_count": {
      "field": "results"
    }
  }
}

Is always 0

How can I correctly filter/count my nested fields?

blackmamba · Accepted Answer · 2016-09-14 10:29:44Z

4

if you want to count the number of documents which have results you can do this.

{
  "size": 0,
  "aggs": {
    "count": {
      "nested": {
        "path": "results"
      },
      "aggs": {
        "top_reverse_nested": {
          "reverse_nested": {}
        }
      }
    }
  }
}

the number count will be in top_reserve_nested doc_count

answered Sep 14, 2016 at 10:29

blackmamba

5563 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Eschon Over a year ago

Thanks that works. I still think there is/should be a way to count the documents without a result directly but until I find it I'll accept your answer.

Nicola · Accepted Answer · 2016-09-14 07:56:15Z

0

"field": "ip"

should be "field": "id"

answered Sep 14, 2016 at 7:56

Nicola

597 bronze badges

2 Comments

Val Over a year ago

I'm not certain since he's looking for documents which don't have any results, ip is probably a field at the root document level.

Eschon Over a year ago

@Val Yes that's the case I edited my question to make this more clear

Collectives™ on Stack Overflow

Elasticsearch filter/count nested fields

2 Answers 2

1 Comment

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related