Paul Chernoch
Paul Chernoch

Reputation: 5553

Count how many documents have an attribute or are missing that attribute in Elasticsearch

How can I write a single Elasticsearch query that will count how many documents either have a value for a field or are missing that field?

This query successfully count the docs missing the field:

POST localhost:9200//<index_name_here>/_search
{
    "size": 0,
    "aggs" : {
        "Missing_Field" : {
            "missing": { "field": "group_doc_groupset_id" }
        }
    }
}

This query does the opposite, counting documents NOT missing the field:

POST localhost:9200//<index_name_here>/_search
{
    "size": 0,
    "aggs" : {
        "Not_Missing_Field" : {
            "exists": { "field": "group_doc_groupset_id" }
        }
    }
}

How can I write one that combines both? For example, this yields a syntax error:

POST localhost:9200//<index_name_here>/_search
{
    "size": 0,
    "aggs" : {
        "Missing_Field_Or_Not" : {
            "missing": { "field": "group_doc_groupset_id" },
            "exists": { "field": "group_doc_groupset_id" }
        }
    }
}

Upvotes: 3

Views: 2890

Answers (2)

ipesanz
ipesanz

Reputation: 23

As per new Elastic search recommendation in the docs:

GET {your_index_name}/_search     #or _count, to see just the value
{
  "query": {
    "bool": {
      "must_not": {    # here can be also "must"
        "exists": {
          "field": "{field_to_be_searched}"
        }
      }
    }
  }
}

Edit: _count allows to have exact values of how many documents are indexed. If there're more than 10k the total is shown as:

  "hits" : {
    "total" : {
      "value" : 10000,     # 10k
      "relation" : "gte"   # Greater than
    }

Upvotes: 0

xeye
xeye

Reputation: 1256

GET indexname/_search?size=0
{
  "aggs": {
    "a1": {
      "missing": {
        "field": "status"
      }
    },
    "a2": {
      "filter": {
        "exists": {
          "field": "status"
        }
      }
    }
  }
}

Upvotes: 3

Related Questions