CODEWITHSUNDEEP
elasticsearch
kdvr
kdvr

Reputation: 55

Elastic always returns 0 buckets on simple aggregations and 0 on nested

I'm making my move from SOLR to Elasticsearch and am struggling to get aggregations to work properly.

In my index there is a single document that resembles the following json structure:

{
      "id": 1,
      "title": "some title",
      "profile": {
        "colour": "GREY",
        "brand": "SOME_BRAND",
      },
      "user_id": 1,
      "created_at": "2017-09-09T13:54:30.304Z",
      "updated_at": "2017-09-09T13:54:50.282Z",
      "email": "[email protected]",
}

I can query my document using:

GET /index/_search
{
  "query": {
    "match_all": {}
  }
}

I want to make (for some reason) to aggregate on e-mail alone. So I use:

GET /index/_search
{
  "query": {
    "match_all": {}
  },
  "aggs": {
    "emails": {
    "terms": {
      "field": "email"
    }
   }
  }
}

If I would do this with SOLR I would receive facets back where there is a single document with email address [email protected].

Elastic however returns:

{
  **SNIP**
 "aggregations": {
   "emails": {
     "doc_count_error_upper_bound": 0,
     "sum_other_doc_count": 0,
     "buckets": []
   }
  }
}

I would also like to retrieve aggregations on the hash e.g. profile['colour']

I tried:

GET /index/_search
{
  "query": {
    "match_all": {}
  },
  "aggs": {
    "profile_colour": {
    "terms": {
      "field": "profile",
      "scripts": {
          "inline": "doc.profile.colour"
      }
    }
   }
  }
}

But again zero results. It seems like every thing I try results in no aggregations. I am missing something very simple here..

Upvotes: 0

Views: 184

Answers (1)

Andrea
Andrea

Reputation: 2764

You JSON document is malformed, please remove the trailing comma here

"brand": "SOME_BRAND",

and here

"email": "[email protected]",

And everything will work (at least here, I'm on ES 1.7.3). Note that in the following example I didn't create a specifying mapping for those fields: 

"aggregations": {
    "emails": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "example.com",
          "doc_count": 1
        },
        {
          "key": "john",
          "doc_count": 1
        }
      ]
    }
  }

and I guess it's wrong as the whole email should be managed as a single keyword.

Upvotes: 1

Related Questions