CODEWITHSUNDEEP
elasticsearch
code_blue
code_blue

Reputation: 571

Return Documents with Null Field in Multi Level Aggregation

We are using Multi Level Aggregation. We have Buckets of City and each Bucket has Buckets of Class. For Few documents Class is Null and in such cases an empty bucket is returned for the City. Please refer to below response:

Sample Output:

"aggregations":
{
  "CITY":{
    "buckets":[
      {
        "key":"CITY 1",
        "doc_count":2
        "CLASS":{
          "buckets":[
            {
              "key":"CLASS A",
              "top_tag_hits":{
                
              }
            }
          ]
        }
      },
      {
        "key":"CITY 2",
        "doc_count":2
        "CLASS":{
          "buckets":[
            
              
            
          ]
        }
      },
    ]
      
    
  }
}

Here the key CITY 2 has an empty bucket of CLASS as all documents under key CITY 2 has the field CITY as null. But we are having a doc count. How can we return documents under the bucket when terms field is null

Update: Field Mapping for CLASS:

"CLASS":
        {
                    "type": "string",

                    "index_analyzer": "text_with_autocomplete_analyzer",
                    "search_analyzer": "text_standard_analyzer",
                    "fields": {
                        "raw": {
                            "type": "string",
                             "null_value" : "na",
                            "index": "not_analyzed"
                        },
                        "partial_matching": {
                            "type": "string",
                            "index_analyzer": "text_with_partial_matching_analyzer",
                            "search_analyzer": "text_standard_analyzer"
                        }
                    }
                }

Please refer to mapping to solve the issue.

Upvotes: 4

Views: 2864

Answers (1)

Val
Val

Reputation: 217294

You can use the missing setting for the terms aggregation in order to handle buckets with missing values. So in your case, you'd do it like this:

{
  "aggs": {
    "CITY": {
      "terms": {
        "field": "city_field"
      },
      "aggs": {
        "CLASS": {
          "terms": {
            "field": "class_field",
            "missing": "NO_CLASS"
          }
        }
      }
    }
  }
}

With this setup, all documents that don't have a class_field field (or a null value) will land in the NO_CLASS bucket.

PS: Note that this only works since ES 2.0 and not in prior releases.

Upvotes: 7

Related Questions