CODEWITHSUNDEEP
elasticsearchaggregation
bracchetto
bracchetto

Reputation: 43

How to aggregate by substring in elasticseach

I have to index many document like this:

POST /example/doc
{
 id : "type-name",
 foo: bar
}

and i would like to retrieve a list of all the type that are present. For example

 POST /example/doc
 {
     id : "AAA-123",
     foo: bar
 }
 POST /example/doc
 {
     id : "AAA-456",
     foo: bar
 }
 POST /example/doc
 {
     id : "BBB-123",
     foo: bar
 }

and ask elasticseaarch to give me a list where i have AAA and BBB.

UPDATE I've also solved using a custom analyzer

"settings": { 
        "analysis": {
            "char_filter" : {
                "remove_after_minus":{
                    "type":"pattern_replace",
                    "pattern":"-(.*)",
                    "replacement":""
                }
            },
            "analyzer": {
                "id_analyzer":{
                     "tokenizer" : "standard",
                    "char_filter" : ["remove_after_minus"]
                }
            }
        }
    }

Upvotes: 4

Views: 3032

Answers (1)

VirgileD
VirgileD

Reputation: 757

If you keep the standard analyzer, the id will be split at the "-". So, if for your types lower and upper case are the same, you can just go with a simple facet query

curl -XPOST  "http://localhost:9023/index/type/_search?size=0&pretty=true" -d
'{
    "query" : {
        { "regexp":{ "id": "[A-Z]+" }
    },
   "facets" : {
       "id" : {
           "terms" : {
               "field" : "id",
               "size" : 50
            }
        }
    }
}'

should give you somtehing that you can use.

Upvotes: 2

Related Questions