0

I have indexed around 30K documents in an ElasticSearch index. Each of these documents has a field called severity, which is an Integer value. These integers can range from 0 to 5, in increments of 1 (0,1,2,3,4,5). I would like to get a count of the number of documents with severity 0, severity 1, severity 2, etc....

I have tried value_count and range, but they both seem to be unsuitable for my purpose.

This is what one of my documents looks like. Some values have been removed, but the essential thing is to aggregate based on severity

{
   "_index": "incident_db",
   "_type": "incidents",
   "_source": {
      "incident": {
         "name": "something",
         "severity": 3
      }
   }
}

1 Answer 1

3

Why not simply using a terms aggregation like this:

POST /incident_db/_search
{
  "size": 0,
  "aggs": {
    "counts": {
      "terms": {
        "field": "incident.severity"
      }
    }
  }
}
Sign up to request clarification or add additional context in comments.

2 Comments

Thanks! I didnt realize in my n00bness that I can do a term search in ES.
Sorry, I meant to immediately do that, but it didnt allow me to. Thanks again

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.